This vulnerability arises from a TOCTOU race condition in GNU tar's handling of incremental backups and restores, specifically in the dumpdir 'X' rename process. A local attacker who can write to the directory being backed up and has access to the restore system can cause the restore operation to escape the intended extraction directory, creating, renaming, or overwriting files or directories outside it. This can lead to unauthorized file modifications or privilege escalation. The attacker does not need to craft or alter the archive, and restoring into a new directory without the -P option does not prevent exploitation. Red Hat is assessing the impact for the tar package in supported products. No official fix or patch has been confirmed yet. The vendor advisory recommends avoiding restoration of incremental backups on systems accessible to untrusted users who could have modified the backed-up data.

The vulnerability allows a local attacker with write access to backed-up directories and access to the restore system to cause files or directories to be created, renamed, or overwritten outside the intended extraction directory during restore. This can result in unauthorized modification of files and, in some cases, privilege escalation. The integrity of the system can be compromised without requiring the attacker to modify the backup archive itself. Confidentiality and availability impacts are not indicated.

Red Hat advises avoiding restoring incremental backups on systems where untrusted users have shell access, especially if they could have modified or controlled any of the backed-up data. Restoration of backups containing user-controlled content should only be performed on systems inaccessible to those users. No official patch or fix is currently confirmed; check the Red Hat advisory for updates. Standard backup and restore workflows, including extracting into a new directory without the -P option, do not mitigate this issue.