A critical vulnerability, codenamed TARmageddon (CVE-2025-62518), has been discovered in async-tar, a popular Rust library for handling tar archives. The flaw allows a specially crafted archive to unpack files from a hidden, nested archive, enabling attackers to bypass security verification systems.

Widespread Impact

The vulnerability isn't limited to async-tar. It also affects several widely-used forks and projects that depend on it, including:

Libraries like tokio-tar, krata-tokio-tar, and astral-tokio-tar.
The uv package manager, a high-performance replacement for Python's 'pip'.
The testcontainers toolkit for running Docker containers in tests.
The wasmCloud WebAssembly runtime.

The affected libraries are immensely popular. In the last 90 days, async-tar was downloaded 1.3 million times, tokio-tar 2.2 million, and testcontainers 2.9 million.

The Technical Flaw

A conceptual diagram of the vulnerability.

A conceptual diagram of the vulnerability.

The vulnerability stems from an incorrect stream position calculation when parsing different size values in `ustar` and `PAX` headers. Vulnerable libraries incorrectly use the size from the outdated `ustar` header instead of the modern `PAX` header.

An attacker can exploit this by creating a TAR archive with a zero-size entry in the `ustar` header but the actual size in the `PAX` header. This tricks the library into mistakenly processing the file's content—which can be another tar archive—as a new set of TAR headers, leading to the unexpected extraction of its contents.

Exploitation and Mitigation

A proof-of-concept demonstrating how to create such malicious archives is available on GitHub. Fortunately, patches have been released to address the issue:

While official releases for other libraries are pending, third-party patches have been prepared for astral-tokio-tar, async-tar, and krata-tokio-tar.

Severity and Attack Scenarios

The vulnerability has been assigned a high severity score of 8.1 out of 10, as it could be used to overwrite files during extraction. However, for the uv package manager, the vulnerability is considered less critical, since an attacker who can modify an archive could achieve code execution more directly through malicious build scripts.

The real danger lies in its ability to deceive. A malicious archive can pass automated security scans and manual audits because the harmful payload is hidden within a nested archive that verifiers would not expect to be unpacked.
Security Researchers

A hypothetical attack could involve uploading a compromised package to a repository like PyPI. The main archive would appear legitimate with a clean pyproject.toml. However, when installed with a vulnerable version of uv, the clean config file would be overwritten by a malicious version from the hidden archive, leading to arbitrary code execution during the build process.

#news #rust