CVE-2024-11612

What it actually does

The flaw is a logic error in 7-Zip's CopyCoder stream processing that causes an infinite loop when handling certain crafted input streams.

Why it matters to the business

Systems running affected older Ubuntu packages that use 7-Zip for archive handling can be rendered unresponsive, disrupting backup, compression, or file-extraction workflows with low but non-zero likelihood of exploitation.

How an attack unfolds

An attacker supplies a specially crafted stream or archive to any application or service that invokes the vulnerable 7-Zip library; the library enters an infinite loop while processing the stream, consuming CPU and preventing further operation until the process is terminated or the system is restarted.

How to fix it

Upgrade affected Ubuntu packages to the listed fixed versions: linux 3.13.0-98.145, linux-aws 4.4.0-1002.2 or 4.4.0-1001.10, linux-lts-xenial 4.4.0-42.62~14.04.1, linux 4.4.0-42.62, linux-gke 4.4.0-1003.3, linux-hwe 4.8.0-36.36~16.04.1, linux-raspi2 4.4.0-1027.33, linux-snapdragon 4.4.0-1030.33, linux-lts-vivid 3.19.0-71.79~14.04.1.

How to confirm the fix worked

Verify the running kernel package version matches one of the fixed releases above and confirm that 7-Zip processes terminate normally when handling previously triggering streams.

Typical attack path

1. Identify a target service or application that uses 7-Zip for decompression or archive handling
2. Craft a malicious stream or archive file that triggers the CopyCoder logic error
3. Deliver the file via network upload, email attachment, or shared storage
4. Trigger processing of the malicious input, causing the infinite loop and denial of service

How to detect it

Review process accounting and system logs for 7-Zip or p7zip processes that exhibit sustained high CPU usage without completing; correlate with file-processing events involving untrusted archives.

What your security team should do

• Prioritize patching all listed Ubuntu 14.04 and 16.04 LTS systems to the supplied fixed kernel packages
• Inventory applications and services that depend on 7-Zip and schedule upgrades
• Monitor CPU utilization on systems that process untrusted archives until patches are applied