Full Report
CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-66484 to CVE-2026-66486) found in GNU cpio software.
Analysis Summary
# Vulnerability: Multiple Flaws in GNU cpio
## CVE Details
- **CVE ID:** CVE-2026-66484, CVE-2026-66485, CVE-2026-66486
- **CVSS Score:** Not explicitly provided in the source (Typically High for Path Traversal/DoS)
- **CWE:**
- CWE-22 (Path Traversal)
- CWE-789 (Memory allocation with excessive size value)
- CWE-116 (Improper Encoding or Escaping of Output)
## Affected Systems
- **Products:** GNU cpio
- **Versions:** All versions through 2.15
- **Configurations:**
- CVE-2026-66484: Using `copy-in` mode with the `--no-absolute-filenames` option.
- CVE-2026-66486: Listing archive members using `cpio -it`.
## Vulnerability Description
GNU cpio is affected by three distinct security flaws:
1. **CVE-2026-66484 (Path Traversal):** When extracting tar archives, the software fails to sanitize hard-link targets. While filenames are normalized, the `link_to_name` function processes absolute paths for hard links without validation, allowing files to be linked outside the intended directory even when absolute filenames are disabled.
2. **CVE-2026-66485 (Denial of Service):** The `make_path` function uses `alloca` to allocate memory on the stack based on archive-controlled pathnames. An excessively long pathname triggers a stack overflow, crashing the process.
3. **CVE-2026-66486 (Output Injection):** Archive member listing does not quote or escape filenames. Malicious archives can include member names with ANSI escape sequences or newlines to forge output or inject terminal control sequences.
## Exploitation
- **Status:** PoC available (coordinated disclosure via AFINE Team)
- **Complexity:** Medium
- **Attack Vector:** Local (via a crafted archive file provided to a victim)
## Impact
- **Confidentiality:** Low/Medium (Terminal injection can lead to data exfiltration in specific environments)
- **Integrity:** High (Arbitrary hard-link creation can overwrite or link to sensitive files)
- **Availability:** High (Process crash/Denial of Service)
## Remediation
### Patches
Users should update to a version containing the following Git commits or apply them manually:
- **CVE-2026-66484:** e2b9cbdd3354d2b1569b7390d1bc15c1930559ad
- **CVE-2026-66485:** 3cd514031371d8aeeaf2048aa10103e02831aaa9
- **CVE-2026-66486:** 2ff9600c9ef32e88759843cdbde74c8db5ae9b30
### Workarounds
- Avoid extracting or listing archives from untrusted or unknown sources.
- Use sandboxed environments for processing external archive files.
## Detection
- **Indicators of compromise:** Presence of unexpected hard links in the file system after extraction.
- **Detection methods and tools:** Audit terminal logs for suspicious ANSI escape sequences when running `cpio -it`. Monitor for `cpio` process crashes (segmentation faults) when processing specific archive files.
## References
- CERT Polska Advisory: hxxps://cert[.]pl/en/posts/2026/08/vulnerabilities-in-gnu-cpio/
- CVE Records:
- hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-66484
- hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-66485
- hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-66486