REDHAT-BUG-2533007: Path Traversal
BusyBox provides lightweight Unix utilities as a single binary. A path traversal vulnerability exists in the dpkg-deb extraction path in archival/libarchive/getheaderar.c. The ar container handler flushes deferred symlinks (via createlinksfromlist() at line 133) inside the per-member loop, rather than once after all members are processed. The tar, cpio, and unzip front-ends correctly flush deferred symlinks after the main loop (tar.c:1269, cpio.c:578, unzip.c:1059), but the ar path does not follow this pattern.
The deferred-symlink mechanism (unsafesymlinktarget.c:13) exists to prevent directory traversal: symlinks with absolute targets or '..' components are deferred until after all archive members are extracted, so that no subsequent member can traverse them. By flushing per ar member, the ar path breaks this invariant: a symlink deferred from the first data.tar member is placed on disk before the second data.tar member is parsed.
A crafted .deb containing two uncompressed data.tar ar members can exploit this: the first declares a symlink whose target is the filesystem root, and the second declares a regular file whose path is resolved through that live symlink, writing a file outside the extraction root.
Constraints: only uncompressed data.tar members work (compressed members cause setupunziponfd() to replace srcfd with a pipe, making the subsequent lseek fail). filteracceptlistreassign() does not remove matched entries from the accept list, so duplicate member names are accepted. BBSUIDDROP is set for the dpkg-deb applet, preventing setuid escalation.
The reporter states the bug was introduced by commit 8c24af9dc (2018-05-22), affecting versions 1290 through current master. No fixing commit exists. Reproduced on Fedora busybox-1.37.0-7.fc44, Debian 13, and Ubuntu 24.04 LTS.
Reported by Shubham Raj, Causal Security. PSIRT ticket: PSIRTSUPT-23314.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to exploit this issue?
The attacker needs a crafted .deb package containing two uncompressed data.tar ar members. The first member declares a deferred symlink targeting the filesystem root, and the second contains a regular file whose extraction path resolves through that symlink.
Which extraction workflows are affected?
The issue is in BusyBox's dpkg-deb extraction path for ar containers. The described flaw does not apply to the BusyBox tar, cpio, or unzip front-ends, which flush deferred symlinks only after processing all archive members.
What can be done before a fix is available?
Do not extract untrusted .deb packages with the affected BusyBox dpkg-deb path. In particular, avoid processing packages that could contain multiple uncompressed data.tar ar members.