CVE-2017-8844

What it actually does

Heap-based buffer overflow in the read_1g function of liblrzip.so triggered by a malformed archive leads to application crash or potential memory corruption that may allow arbitrary code execution.

Why it matters to the business

Processing untrusted compressed archives can cause sudden application failures, potential system instability, or full host compromise, disrupting backup, archival, and data transfer workflows that rely on lrzip.

How an attack unfolds

An attacker crafts a malicious archive that triggers the overflow in read_1g, then supplies the archive to a victim who opens or extracts it with an affected lrzip binary; the overflow occurs during decompression and may crash the process or allow control-flow hijacking.

How to fix it

Upgrade lrzip to a version that corrects the buffer handling flaw in stream.c; where package managers do not yet provide a fixed build, replace the binary with a rebuilt version from current upstream sources and rebuild any dependent packages.

How to confirm the fix worked

Confirm the installed lrzip and liblrzip.so report a version newer than 0.631 and that the read_1g function no longer performs unbounded reads on crafted inputs; re-test with known-bad archives in an isolated environment.

Typical attack path

1. Craft archive that overflows the heap buffer in read_1g
2. Deliver the archive via email, download link, or shared storage
3. Victim opens or extracts the archive using lrzip or dependent tools
4. Overflow executes, resulting in crash or code execution

How to detect it

Review system logs and crash reports for segmentation faults or heap errors originating from lrzip or liblrzip.so when processing archive files; correlate with file-access timestamps on suspicious .lrz archives.

• liblrzip.so
• read_1g

What your security team should do

• Block or sandbox lrzip execution on untrusted archives until patched builds are deployed
• Scan package repositories and build pipelines for the vulnerable 0.631 release and replace it
• Add lrzip to the list of tools monitored for memory-corruption crashes in endpoint telemetry