This vulnerability arises from a flaw in the containers/storage library's handling of tar archives containing malicious whiteout headers (e.g., victim/.wh.). When processed by functions such as UnpackLayer, ApplyLayer, or ApplyUncompressedLayer, the extraction destination directory can be replaced with an arbitrary file. The issue primarily affects external applications that directly invoke the containers/storage library API. Exploitation requires processing a specially crafted tar archive locally with user interaction. Red Hat container tools themselves are not directly affected. The vulnerability is classified under CWE-59 (Improper Link Resolution Before File Access).

Successful exploitation can lead to replacement of the extraction destination directory with an arbitrary file, potentially allowing an attacker to modify files unexpectedly. The CVSS v3.1 score is 4.4 (medium), reflecting low integrity and availability impact, no confidentiality impact, local attack vector, low attack complexity, no privileges required, and user interaction required. There are no known exploits in the wild. The flaw does not affect confidentiality but can cause limited integrity and availability issues.

According to the Red Hat advisory, no mitigation is currently available or meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor the Red Hat advisory for updates on fixes or mitigations. Since no official fix or workaround is provided, cautious handling of tar archives and limiting processing of untrusted archives is advisable until a patch is released.