Executive brief
A vulnerability in the containers/storage library allows an attacker to replace extraction directories with arbitrary files when processing specially crafted tar archives. This affects container management tools that use the library's archive extraction functions, potentially allowing attackers to overwrite critical files during container image extraction or layer application.
Technical details
The vulnerability exists in the containers/storage library's tar archive extraction functions (UnpackLayer, ApplyLayer, ApplyUncompressedLayer). A crafted tar archive containing a malicious whiteout header (e.g., victim/.wh.) can cause the extraction process to replace the destination directory with an arbitrary file. The root cause is improper link resolution before file access (CWE-59). Exploitation requires processing a specially crafted tar archive with user interaction and local access. An attacker can overwrite files and directories, potentially bypassing access controls or modifying critical files. Red Hat container tools are not directly affected; impact is limited to external applications that directly use the storage library API.
Affected products
- containers storage <UNKNOWN>
Timeline
- 2026-09-15: disclosed