REDHAT-BUG-2571893: Buffer Overflow
A flaw was found in GNU cpio through version 2.15. A stack-based buffer overflow exists in src/tar.c:writeouttarheader() via settarfname().
When generating archives using the ustar or tar formats (e.g., cpio -o -H ustar), settarfname() uses unbounded strcpy() calls to copy user and group names obtained from getpwuid() and getgrgid() into the 32-byte fixed-size tarhdr->uname and tarhdr->gname fields within struct tarheader on the stack. If a file being archived is owned by a user or group whose name exceeds 32 characters (common in LDAP, Active Directory, or container environments), strcpy() overflows the destination buffer and corrupts adjacent stack variables.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems that use GNU cpio to create archives in ustar or tar format are exposed when archived files are owned by users or groups with names longer than 32 characters. This is more likely in environments using LDAP, Active Directory, or container-based identity schemes.
What conditions are required to trigger the overflow?
An archive must be generated using the ustar or tar format, such as with cpio -o -H ustar. At least one file being archived must have an owner or group name exceeding 32 characters.
Are default cpio archive operations affected?
The described overflow is specifically tied to generating ustar or tar archives. The provided information does not establish that other archive formats are affected.
How can I determine whether my archive workflow is at risk?
Review cpio commands and automation for use of -H ustar or tar output. Check whether files included in those archives can be owned by accounts or groups whose names exceed 32 characters.