REDHAT-BUG-2439040: Path Traversal
Affects: BusyBox v1.36.1 and v1.37.0 (likely affects earlier versions too) CVSS: 9.3 (CRITICAL) Component: dataextractall.c in tar extraction - hardlink and symlink handling
Description: Hardlink entries in tar archives are created without validation of the linktarget path. This allows modification of files outside the extraction directory and bypasses existing path traversal mitigations. This vulnerability has higher impact than the path traversal issue as it does not rely on relative paths or the current working directory.
Technical Details: - Hardlink entries can point to absolute paths like /etc/passwd - Symlink entries suffer from the same root cause (missing linktarget validation) - When extraction is performed with elevated privileges, attackers can modify critical system files
Impact: Arbitrary file modification outside extraction directory, privilege escalation when combined with elevated extraction permissions, bypass of path traversal protections.
Note: While hardlinks and symlinks share the same root cause (missing linktarget validation), I'm requesting a single CVE for this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2439040?
The severity of REDHAT-BUG-2439040 is rated as critical with a CVSS score of 9.3.
How do I fix REDHAT-BUG-2439040?
To address REDHAT-BUG-2439040, upgrade BusyBox to versions later than 1.37.0.
Which versions of BusyBox are affected by REDHAT-BUG-2439040?
REDHAT-BUG-2439040 affects BusyBox versions 1.36.1 and 1.37.0, likely impacting earlier versions as well.
What is the nature of the vulnerability in REDHAT-BUG-2439040?
The vulnerability in REDHAT-BUG-2439040 involves inadequate validation of hardlink entries in tar archives.
Can this vulnerability in REDHAT-BUG-2439040 lead to security risks?
Yes, the vulnerability can potentially allow attackers to modify files without proper user permissions.