GNU tar: listing/extraction desynchronization allows hidden file injection

[Alan Coopersmith <alan.coopersmith () oracle com>]

https://lists.gnu.org/archive/html/bug-tar/2026-03/msg00007.html disclosed:
> From:    Guillermo de Angel
> Subject: GNU tar: listing/extraction desynchronization allows hidden file injection (tar -t vs tar -x)
> Date:    Wed, 18 Mar 2026 15:55:41 +0100
>
> Hello,
>
> I am reporting a security issue in GNU tar 1.35 where tar -t and tar -x produce
> different results when processing archives containing non-data-bearing typeflags
> (symlink, chardev, blockdev, FIFO) with a non-zero size field.
>
> Summary:
>
>  - tar -t respects the size field and skips the data blocks
>  - tar -x ignores the size field and parses the data blocks as headers
>  - Result: files embedded in the data region are invisible to listing but are
>    created on disk during extraction
>
> This enables hidden file injection: an attacker can craft a small archive
> (< 3 KB) where tar -t reports N entries but tar -x creates N+M files.
>
> Any security workflow that relies on tar -t for pre-extraction inspection will
> have an incomplete view of the archive contents.
>
> Reproduction (GNU tar 1.35, Ubuntu 24.04):
>
> $ tar -tf desync_chardev.tar
> carrier_entry
> marker.txt
>
> $ mkdir /tmp/test && tar -xf desync_chardev.tar -C /tmp/test
> $ ls /tmp/test/
> carrier_entry injected.txt marker.txt
> ^^^^^^^^^^^^
> not in listing
>
> bsdtar 3.7.2 is consistent in both modes (lists and extracts all 3 entries).
>
> Affected typeflags: '2' (symlink), '3' (chardev), '4' (blockdev), '6' (FIFO).
> Typeflag '5' (directory) is not affected.
>
> I have attached:
>
> 1. Full advisory with root cause analysis and impact assessment
> 2. Standalone PoC generator (Python 3, no dependencies)
> 3. Four minimal PoC archives (one per affected typeflag)
>
> I am happy to coordinate on a disclosure timeline. Please let me know if you
> need additional information or testing.
>
> Regards,
>
> Guillermo de Angel

Red Hat appears to have assigned CVE-2026-5704 to this issue.

Paul Eggert provided a patch in
https://lists.gnu.org/archive/html/bug-tar/2026-03/msg00011.html
which is also available in
https://cgit.git.savannah.gnu.org/cgit/tar.git/commit/?id=b8d8a61b25588caca4efaf9bdd2e3f1a49da77e3

https://lists.gnu.org/archive/html/bug-tar/2026-03/msg00012.html points out
that a similar report was also included in
https://lists.gnu.org/archive/html/bug-tar/2026-02/msg00022.html
along with a number of other bug reports.

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris