An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-88772d0a2d advisory.

    - fix use-after-free bugs introduced by incorrect memleak fixes (CVE-2021-33640)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the libtar package has been released.

The version of libtar installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-33644 advisory.

  - An attacker who submits a crafted tar file with size in header struct being 0 May be able to trigger an     calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read. (CVE-2021-33644)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libtar package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in     the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the     released memory is used (use-after-free). (CVE-2021-33640)

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read. (CVE-2021-33643)

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read. (CVE-2021-33644)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longlink after allocating memory, which may     cause a memory leak. (CVE-2021-33645)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longname after allocating memory, which may     cause a memory leak. (CVE-2021-33646)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-2898 advisory.

    - fix use-after-free bugs introduced by incorrect memleak fixes (CVE-2021-33640)
    - fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:2898 advisory.

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read. (CVE-2021-33643)

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read. (CVE-2021-33644)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longlink after allocating memory, which may     cause a memory leak. (CVE-2021-33645)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longname after allocating memory, which may     cause a memory leak. (CVE-2021-33646)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:2898 advisory.

    The libtar packages contain a C library for manipulating tar archives. The library supports both the     strict POSIX tar format and many of the commonly used GNU extensions.

    Security Fix(es):

    * libtar: out-of-bounds read in gnu_longlink (CVE-2021-33643)

    * libtar: out-of-bounds read in gnu_longname (CVE-2021-33644)

    * libtar: memory leak found in th_read() function (CVE-2021-33645)

    * libtar: memory leak found in th_read() function (CVE-2021-33646)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:2898 advisory.

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read. (CVE-2021-33643)

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read. (CVE-2021-33644)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longlink after allocating memory, which may     cause a memory leak. (CVE-2021-33645)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longname after allocating memory, which may     cause a memory leak. (CVE-2021-33646)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libtar package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read. (CVE-2021-33643)

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read. (CVE-2021-33644)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longlink after allocating memory, which may     cause a memory leak. (CVE-2021-33645)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longname after allocating memory, which may     cause a memory leak. (CVE-2021-33646)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtar package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in     the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the     released memory is used (use-after-free). (CVE-2021-33640)

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read. (CVE-2021-33643)

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read. (CVE-2021-33644)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longlink after allocating memory, which may     cause a memory leak. (CVE-2021-33645)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longname after allocating memory, which may     cause a memory leak. (CVE-2021-33646)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-ccc68b06cc advisory.

    - fix use-after-free bugs introduced by incorrect memleak fixes (CVE-2021-33640)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libtar package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read. (CVE-2021-33643)

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read. (CVE-2021-33644)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longlink after allocating memory, which may     cause a memory leak. (CVE-2021-33645)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longname after allocating memory, which may     cause a memory leak. (CVE-2021-33646)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
211208	Fedora 37 : libtar (2022-88772d0a2d)	Nessus	Fedora Local Security Checks	critical
204190	Photon OS 5.0: Libtar PHSA-2023-5.0-0010	Nessus	PhotonOS Local Security Checks	critical
204073	Photon OS 3.0: Libtar PHSA-2022-3.0-0437	Nessus	PhotonOS Local Security Checks	critical
203367	Photon OS 4.0: Libtar PHSA-2022-4.0-0231	Nessus	PhotonOS Local Security Checks	critical
201829	CBL Mariner 2.0 Security Update: libtar (CVE-2021-33644)	Nessus	MarinerOS Local Security Checks	high
177207	EulerOS Virtualization 3.0.6.0 : libtar (EulerOS-SA-2023-2224)	Nessus	Huawei Local Security Checks	critical
176281	Oracle Linux 8 : libtar (ELSA-2023-2898)	Nessus	Oracle Linux Local Security Checks	critical
176159	AlmaLinux 8 : libtar (ALSA-2023:2898)	Nessus	Alma Linux Local Security Checks	critical
175902	RHEL 8 : libtar (RHSA-2023:2898)	Nessus	Red Hat Local Security Checks	critical
175845	CentOS 8 : libtar (CESA-2023:2898)	Nessus	CentOS Local Security Checks	critical
175163	EulerOS Virtualization 3.0.2.0 : libtar (EulerOS-SA-2023-1753)	Nessus	Huawei Local Security Checks	critical
171144	EulerOS 2.0 SP8 : libtar (EulerOS-SA-2023-1324)	Nessus	Huawei Local Security Checks	critical
169344	Fedora 36 : libtar (2022-ccc68b06cc)	Nessus	Fedora Local Security Checks	critical
166978	EulerOS 2.0 SP5 : libtar (EulerOS-SA-2022-2713)	Nessus	Huawei Local Security Checks	critical

Detections

Analytics

CVE-2021-33644

high

Tenable Plugins

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical