CyberRota Analysis
AI-GeneratedGNU cpio is vulnerable to a stack overflow due to uncontrolled memory allocation in the make_path function, which can be exploited by a crafted cpio archive containing a long nested pathname. This vulnerability can lead to a denial of service, crashing the cpio process when the archive is extracted. Users and organizations utilizing GNU cpio should prioritize applying the fix to mitigate potential disruptions from malicious archives.
Original NVD Description
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9