CVE-2021-20193: 
NixOS vulnerability analysis and mitigation

A memory leak vulnerability was discovered in GNU Tar versions 1.33 and earlier, identified as CVE-2021-20193. The vulnerability exists in the read_header() function in list.c of the tar application, where memory pointed to by 'next_long_name' and 'next_long_link' was not being properly freed upon return of the routine (GNU Bug Report, Gentoo Security).

The vulnerability stems from a memory management issue in the read_header() function within list.c. When processing archive headers, the application fails to properly free memory allocated for 'next_long_name' and 'next_long_link' variables before returning from the function. The issue has been assigned a CVSS score of 3.3, indicating low severity, with local attack vector, low attack complexity, and requiring user interaction (Oracle Bulletin).

The vulnerability can lead to uncontrolled consumption of memory when processing specially crafted tar archives. When exploited, this could result in a denial of service condition by degrading the availability of the tar tool. During testing, some malformed inputs caused the application to remain in a loop for over 7 seconds before returning (GNU Bug Report).

The vulnerability has been fixed in GNU Tar version 1.34. The fix involves modifying the read_header() function to properly free the memory before returning. Users are advised to upgrade to version 1.34 or later. For Ubuntu users, specific package versions are available: Ubuntu 20.04: tar-1.30+dfsg-7ubuntu0.20.04.2, Ubuntu 18.04: tar-1.29b-2ubuntu0.3 (Ubuntu Notice).