tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.
CVSS Details
CVSS Score
5.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Configurations (Affected Products)
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* - VULNERABLE
Go (archive/tar) (具体受影响版本请参考官方公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
package main
import (
"archive/tar"
"bytes"
"fmt"
"io"
"os"
)
// This PoC demonstrates the potential for memory exhaustion.
// It creates a tar archive with a sparse file header (conceptual).
// Actual exploitation requires specific "old GNU sparse map" formatting.
func main() {
// Create a buffer to hold the tar archive
var buf bytes.Buffer
tw := tar.NewWriter(&buf)
// In a real exploit, the header would be manually crafted to include
// a massive number of entries in the "old GNU sparse map".
// Standard tar writers might not allow creating the malformed structure easily,
// so this code represents the *reader* side that crashes.
// Simulating reading a malicious archive
// (Assuming 'malicious.tar' is a file crafted with numerous sparse entries)
f, err := os.Open("malicious_sparse.tar")
if err != nil {
fmt.Println("Please provide a crafted malicious_sparse.tar file")
return
}
defer f.Close()
tr := tar.NewReader(f)
for {
_, err := tr.Next()
if err == io.EOF {
break
}
if err != nil {
fmt.Printf("Error parsing tar: %v\n", err)
return
}
// The allocation happens internally during Next() or Read()
}
}