CVE-2018-20482

A local user can trigger this vulnerability by modifying a file that is currently being archived by a different user's process, such as a system backup running as root. This modification involves shrinking the file while GNU Tar is reading it. The vulnerability is triggered when the `sparse_dump_region()` function in `sparse.c` does not properly check for the end of the file after a read operation, leading to an infinite loop. This can occur with both sparse and non-sparse files when the `--sparse` option is enabled [ref_id=1].

The vulnerability resides in the `sparse_dump_region()` function within the file `src/sparse.c`. This function is responsible for handling sparse regions of files during the archiving process. The issue arises because it does not adequately check for the end-of-file condition after a `safe_read()` operation, particularly when the file being processed shrinks during the read [ref_id=1].

The advisory indicates that the `sparse_dump_region()` function in `sparse.c` does not check for end-of-file conditions after a `safe_read()` call, which can lead to an infinite loop if the file being processed shrinks. The recommended remediation is to update GNU Tar to a version that addresses this issue. The patch is not provided in the bundle, but the advisory suggests that the fix involves correctly handling the end-of-file condition within `sparse_dump_region()` to prevent the infinite read loop [ref_id=1].

The easiest way to reproduce this is under a debugger like GDB. Set a breakpoint on `sparse_dump_region()`. Start creating a tar file with `--sparse`. After the breakpoint triggers, use a tool like `truncate(1)` to shorten the file. `sparse_dump_region()` will then enter an infinite loop. If the file is re-enlarged, the function will recover [ref_id=1].