TARmageddon: Reflections on a Multi-Crate CVE
Talkat RustConf 2026 · on Thursday, 2026-09-10· at 14:35· Room 510bd | Palais des Congrès de Montréal, Palais des Congrès de Montréal·
summary
Finds a tar boundary parsing bug in async tar implementations, tracked as CVE-2025-62518, that lets a crafted PAX-enabled archive hide and overwrite files leading to potential RCE; impact hits testcontainers, WASMCloud, CI tooling and Python package scanners and rates 8.1 severity. Reproduction artifacts and a generator live in the linked repo, a comparator tool confirms parser divergences, and fixes are a straightforward tar pax size override plus UID/GID handling. Root cause is an async fork graph that duplicated parsing logic so patches didn’t propagate.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 2:13Discovery of TARmageddon
- 6:42Vulnerability details and impact
- 13:20Fork graph and Rust ecosystem issues
- 20:11SANS IO model for Rust crates
- 24:49Demonstration of the bug
- 30:33Ecosystem improvements and open questions
- 32:51Q&A session
related talks
25mTarmageddon: One Bug, Four Forks, and a Disclosure Scavenger Hunt
29mUnarchiving vulnerabilities and avoiding tar-pits
31mA survey of recent RubyGems CVEs
29mSecuring Container Runtimes -- How Hard Can It Be?
34mExploiting a Slightly Peculiar Volume Configuration with SIG-Honk
35mHow To Find The Next Great Deserialization CVE
01h 02mPrompt-Jacking: The Rise of a New Supply Chain Risk
39mExploiting Blind Memory Corruption in Cloud Services