Moderate Security Vulnerability in libtar: Out-of-Bounds Reads and Memory Leaks
Summary
RLSA-2023:2898: Moderate: libtar security update. Affects libtar versions < 0:1.2.20-17.el8. Fixed in 0:1.2.20-17.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libtar is a C library designed for manipulating tar archives, supporting both the strict POSIX tar format and various GNU extensions. It is widely used in applications that require archive management. However, recent vulnerabilities have been identified that could potentially compromise the integrity and security of applications utilizing this library.
Vulnerability Detail
The vulnerabilities in libtar include out-of-bounds reads in the gnu_longlink and gnu_longname functions (CVE-2021-33643 and CVE-2021-33644), which can lead to unauthorized access to memory. Additionally, there are memory leaks in the th_read() function (CVE-2021-33645 and CVE-2021-33646), which can degrade system performance over time. These vulnerabilities can be exploited by attackers to execute arbitrary code or crash the application, posing significant risks to system security.
How To Fix
Minimum fixed version
0:1.2.20-17.el8
This is the first release that contains the fix.
sudo dnf update libtarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if updating the package is not feasible, consider limiting the use of libtar in your applications or implementing additional security measures to monitor memory access patterns. However, this is not a long-term solution and updating is strongly recommended.
Conclusion
The vulnerabilities identified in libtar pose significant risks to applications that utilize this library. It is crucial to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for libtar →
FAQ
The main vulnerabilities include out-of-bounds reads and memory leaks that can lead to unauthorized memory access and performance degradation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a moderate severity level.
Yes, a patch is available in the form of an updated libtar package version 0:1.2.20-17.el8.
If you cannot update the package, consider implementing additional security measures to monitor memory access, but plan to update as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for libtar.
