Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from 5.10.0-60.18.0 before 5.10.0-183.0.0.

After tarclose(), libtar.c releases the memory pointed to by pointer t. After tarclose() is called in the list() function, it continues to use pointer t: freelonglinklongname(t->thbuf) . As a result, the released memory is used (use-after-free).

An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnulongname, causing an out-of-bounds read.

Last updated 31 March 2025

Last updated 31 March 2025

atune before 0.3-0.8 log in as a local user and run the curl command to access the local atune url interface to escalate the local privilege or modify any file. Authentication is not forcibly enabled in the default configuration.