tOS Archive Extraction — Arbitrary File Write/Delete via Path Traversal
In tar_extract of tarfmt.c and the extraction routine of zipfmt.c, archive entry names are used to construct destination file paths without sanitizing '.' or '..' path components or absolute paths. This allows a specially crafted tar or zip archive to write, overwrite, or delete arbitrary files outside the intended extraction directory when extracted via the 'tar x' or 'unzip' shell commands. User interaction is required only to the extent of extracting an attacker-supplied archive.
While scanning the filesystem code as part of ASI-2026-0001, we suspected a similar trust issue might exist in archive extraction. We reviewed the entry-name handling logic in tarfmt.c and zipfmt.c and found that archive entry names were joined to the destination path without any validation at all.
Each entry name inside an archive was copied verbatim and appended to the destination directory via a plain join() helper. This helper never checked for '..' components or a leading '/'. The resulting path was used directly in mkdir/delete/create/write operations — the same pattern was repeated in both tar_extract() and the zip extraction loop.
An attacker crafts a specially prepared tar or zip archive containing an entry name with a path-traversal pattern such as '../../etc/passwd'. When the victim extracts this archive with 'tar x' or 'unzip', the kernel writes to the target path without ever questioning the entry name. As a result, arbitrary files outside the extraction directory can be overwritten, created, or deleted. The only user interaction required is extracting the malicious archive.
The archive format parsers (tarfmt.c, zipfmt.c) implicitly trusted metadata coming from inside the archive, including file names. The path-joining logic was written purely for functionality, with no security boundary in mind.
We added an unsafe_entry_name() check to both files. This function rejects any entry whose name is absolute or contains a '..' component before it gets joined to the destination path. Such entries are skipped rather than extracted; the rest of the archive continues to extract normally.
CWE-22, CWE-73
Artfical DT Developer Talha Berk Arslan