This vulnerability exists in GNU tar's incremental dumpdir 'X' rename handling, where a TOCTOU race condition allows a local attacker with write access to a directory being backed up to affect the restore process on the target system. During restoration, the attacker can cause files or directories to be created, renamed, or overwritten outside the intended extraction directory, leading to unauthorized file modifications or privilege escalation. The attacker does not need to modify the archive itself, and extracting into a new directory without the -P option does not prevent exploitation. Red Hat has acknowledged the issue affecting their Hardened Images and released security updates for the tar package (tar-1.35-9.1.hum1) to fix this vulnerability.

The vulnerability allows a local attacker with write access to a directory included in an incremental backup and access to the restore system to cause unauthorized file modifications or privilege escalation by escaping the intended extraction directory during restore. This compromises the integrity of the system by enabling modification or overwriting of files outside the expected restore path. Confidentiality and availability impacts are not indicated. The CVSS 3.1 base score is 4.4 (medium severity) with local attack vector, high attack complexity, low privileges required, and user interaction required.

Red Hat has released a security update for the tar package (tar-1.35-9.1.hum1) that addresses this vulnerability. Users of Red Hat Hardened Images should apply this update promptly. Until the update is applied, do not perform incremental restores (-G/-g) from untrusted archives and avoid restoring incremental backups on systems accessible to untrusted users. Perform restoration only on systems inaccessible to untrusted users. Standard backup and restore workflows do not mitigate this issue, so applying the official patch is the recommended remediation.