Tarmageddon: One Bug, Four Forks, and a Disclosure Scavenger Hunt
summary
Discovery of a parsing bug in tokio-tar called Tarmageddon reveals a PAX header parsing flaw that lets an unpacker treat embedded data as files and enables container poisoning or Python build hijacks leading to potential RCE. The defect exists across four forks and ~120 crates depend on affected variants, forcing a 60-day embargo, manual maintainer hunts, and bespoke patches per fork; one fork remains unmaintained while Astral’s fork is patched and recommended as the safer migration path.
AI-written summary · about
chapters (10)
- 0:00Tar file vulnerability discovery
- 3:12Tokyo tar library bug
- 7:05Attack scenarios from tar flaw
- 9:55Chain of forks behind bug
- 12:01Disclosure challenges in open source
- 13:47Why bug disclosure was hard
- 17:41Open source project lifespan
- 19:26Supportability declarations
- 21:14Improving open source sustainability
- 23:02Final results and patches
related talks
41mTARmageddon: Reflections on a Multi-Crate CVE
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain
39mInsecure Containers? Continuous Defense Against Open Source Exploits
13mKeynote: Hacking the OSS Supply Chain
29mUnarchiving vulnerabilities and avoiding tar-pits
32mBalancing Developer Fre...
38mPentesting Hex: Real Findings from the Ægis Initiative
28mDissecting the Discovery of the 0-Day Supply Chain Vulnerability in Argo CD