CVE-2026-32288 Go语言tar.Reader内存耗尽漏洞

package main import ( "archive/tar" "bytes" "fmt" "io" "os" ) // This PoC demonstrates the potential for memory exhaustion. // It creates a tar archive with a sparse file header (conceptual). // Actual exploitation requires specific "old GNU sparse map" formatting. func main() { // Create a buffer to hold the tar archive var buf bytes.Buffer tw := tar.NewWriter(&buf) // In a real exploit, the header would be manually crafted to include // a massive number of entries in the "old GNU sparse map". // Standard tar writers might not allow creating the malformed structure easily, // so this code represents the *reader* side that crashes. // Simulating reading a malicious archive // (Assuming 'malicious.tar' is a file crafted with numerous sparse entries) f, err := os.Open("malicious_sparse.tar") if err != nil { fmt.Println("Please provide a crafted malicious_sparse.tar file") return } defer f.Close() tr := tar.NewReader(f) for { _, err := tr.Next() if err == io.EOF { break } if err != nil { fmt.Printf("Error parsing tar: %v\n", err) return } // The allocation happens internally during Next() or Read() } }