CVE-2026-90954: Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.
Other sources
BusyBox provides lightweight Unix utilities as a single binary. A path traversal vulnerability exists in the dpkg-deb extraction path in archival/libarchive/getheaderar.c. The ar container handler flushes deferred symlinks (via createlinksfromlist() at line 133) inside the per-member loop, rather than once after all members are processed. The tar, cpio, and unzip front-ends correctly flush deferred symlinks after the main loop (tar.c:1269, cpio.c:578, unzip.c:1059), but the ar path does not follow this pattern.
The deferred-symlink mechanism (unsafesymlinktarget.c:13) exists to prevent directory traversal: symlinks with absolute targets or '..' components are deferred until after all archive members are extracted, so that no subsequent member can traverse them. By flushing per ar member, the ar path breaks this invariant: a symlink deferred from the first data.tar member is placed on disk before the second data.tar member is parsed.
A crafted .deb containing two uncompressed data.tar ar members can exploit this: the first declares a symlink whose target is the filesystem root, and the second declares a regular file whose path is resolved through that live symlink, writing a file outside the extraction root.
Constraints: only uncompressed data.tar members work (compressed members cause setupunziponfd() to replace srcfd with a pipe, making the subsequent lseek fail). filteracceptlistreassign() does not remove matched entries from the accept list, so duplicate member names are accepted. BBSUIDDROP is set for the dpkg-deb applet, preventing setuid escalation.
The reporter states the bug was introduced by commit 8c24af9dc (2018-05-22), affecting versions 1290 through current master. No fixing commit exists. Reproduced on Fedora busybox-1.37.0-7.fc44, Debian 13, and Ubuntu 24.04 LTS.
Reported by Shubham Raj, Causal Security. PSIRT ticket: PSIRTSUPT-23314.
— Red Hat
Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker must convince a user or process to extract a specially crafted .deb archive using BusyBox dpkg-deb. The archive needs two data.tar members: one that creates a deferred symlink to an absolute path and another that writes a file through that symlink.
What is the practical impact of a successful exploit?
The crafted archive can cause files to be written outside the intended extraction directory. The description states this can permit arbitrary file writes to arbitrary locations accessible to the extracting user or process.
Are other BusyBox archive extraction utilities affected by the same deferred-symlink behavior?
The described ordering issue is specific to the dpkg-deb ar archive handler. BusyBox tar, cpio, and unzip are described as flushing deferred symlinks once after processing all members rather than after each member.
How can I identify potentially exposed extraction workflows?
Review systems and automation that use BusyBox dpkg-deb to extract .deb packages, especially where packages originate from untrusted or insufficiently validated sources. The affected code path is in archival/libarchive/get_header_ar.c.