Memory Exhaustion in modern-tar via Negative Entry Sizes

Executive Summary

This vulnerability is a memory exhaustion issue in modern-tar versions 0.3.5 through 0.8.5. Attackers can craft a malicious archive with non-octal bytes that cause readOctal() to produce negative entry sizes. When unpacked, this leads to indefinite memory buffering, exhausting system resources and preventing further processing.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the modern-tar library versions 0.3.5 through 0.8.5. To detect it, check if your system has modern-tar installed and verify the version. Use commands like 'npm list modern-tar' for Node.js environments or 'pip show modern-tar' for Python environments. If the version falls within the vulnerable range, the system is affected.

Useful 0 Not Useful 0

Impact Analysis

An attacker could crash your application or system by sending a specially crafted tar archive. This could lead to denial-of-service conditions, disrupting services that rely on the modern-tar library for archive operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting system memory, which may disrupt services handling sensitive data. For GDPR, this could impact availability of personal data processing systems, potentially violating Article 32 requirements for resilience. For HIPAA, service disruptions might affect access to protected health information, compromising integrity and availability controls under the Security Rule.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update modern-tar to a version outside the vulnerable range (0.3.5-0.8.5). If updating is not possible, consider removing the library or replacing it with an alternative like GNU tar. Monitor for unusual memory usage or crashes in applications using modern-tar.

Useful 0 Not Useful 0