CVE-2026-79699 in Buildah
Summary
by MITRE • 09/15/2026
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/20/2026
The vulnerability identified in the containers/storage library represents a critical security flaw within the image layer processing mechanisms used by container runtimes and registries. This issue specifically affects functions such as UnpackLayer, ApplyLayer, and ApplyUncompressedLayer, which are responsible for extracting tar archives that constitute container filesystem layers. The core of the problem lies in how these functions handle special files known as whiteout headers during extraction. In the context of overlay filesystems like OverlayFS or AUFS, whiteouts are used to indicate file deletions within a layer relative to its parent. A properly formed whiteout header typically consists of a filename prefixed with .wh., signaling that the corresponding file in the lower layers should be hidden from view when the upper layer is applied.
The technical flaw arises because the library fails to adequately validate or sanitize these whiteout headers before processing them for extraction destinations. An attacker can craft a malicious tar archive containing a specially constructed whiteout header, such as victim/.wh., where the target path points outside the intended container filesystem root or targets critical system directories within the host environment if permissions allow. When the storage library processes this malformed input, it interprets the whiteout directive not merely as an instruction to hide a file in the virtual overlay view but potentially executes operations that replace the destination directory with an arbitrary file. This behavior deviates from the expected secure handling of layer metadata and introduces a path traversal-like effect through the misuse of filesystem control structures rather than traditional symlink or hardlink tricks often seen in other archive vulnerabilities.
The operational impact of this vulnerability is severe, particularly for environments where container images are pulled from untrusted sources or when build processes involve processing user-supplied tarballs without sufficient isolation. By exploiting this flaw, an attacker could achieve arbitrary file write capabilities on the host system if the process running the container runtime has elevated privileges. This can lead to privilege escalation, data exfiltration, or the installation of persistent backdoors by overwriting critical binaries or configuration files with malicious content disguised as whiteout artifacts. The ability to replace directories with files disrupts the integrity of the filesystem hierarchy and can cause denial of service conditions for applications relying on those paths while simultaneously providing a foothold for further exploitation within the host environment.
This vulnerability aligns closely with CWE-20, which describes Improper Input Validation, as the library fails to restrict or validate user-supplied input that influences file system operations. It also relates to CWE-78, Improper Neutralization of Special Elements used in an OS Command, although the mechanism is specific to filesystem manipulation rather than direct command injection. From a threat modeling perspective using MITRE ATT&CK, this flaw facilitates techniques associated with Initial Access and Privilege Escalation, specifically leveraging container escape vectors or abusing image processing pipelines to gain unauthorized access to underlying infrastructure resources. Security teams should treat any component that processes untrusted tar archives as a potential attack surface requiring strict validation of internal structures like whiteout headers.
Mitigation strategies must focus on updating the containers/storage library to versions where this logic has been corrected to properly isolate and validate whiteout operations within the designated container root directory boundaries. Developers integrating this library should ensure they are using patched releases that enforce stricter path canonicalization and prevent the resolution of paths outside the intended extraction context. Additionally, running container runtimes with minimal privileges and utilizing security profiles such as SELinux or AppArmor can provide an additional layer of defense by restricting file system modifications regardless of application-level vulnerabilities. Regular auditing of image sources and implementing strict content verification policies for tar archives used in CI/CD pipelines are essential practices to reduce the risk of encountering crafted malicious inputs that exploit this specific parsing logic flaw.