CVE-2024-48957

What it actually does

Out-of-bounds memory access occurs in execute_filter_audio when processing crafted RAR archives because the source pointer can advance past the destination buffer in archive_read_support_format_rar.c.

Why it matters to the business

Systems that unpack or inspect untrusted RAR files may crash or allow arbitrary code execution, disrupting build pipelines, container image creation, and any software distribution workflows that rely on libarchive.

How an attack unfolds

An attacker crafts a malicious RAR archive that manipulates the audio filter state so src advances beyond dst during decompression; when the victim application uses a vulnerable libarchive version to read the archive, the out-of-bounds access is triggered, potentially leading to memory corruption.

How to fix it

Upgrade libarchive to a version containing commit 12ecf8418ab3595d66cdea1abadcea8b6a9d288b (equivalent to 3.7.5 or later) or update github.com/moby/buildkit to 0.12.5 or newer; rebuild and redeploy any dependent images or binaries.

How to confirm the fix worked

Verify installed libarchive version is 3.7.5 or later and buildkit is 0.12.5 or later; run regression tests with known-malformed RAR samples to confirm absence of crashes or sanitizer violations.

Typical attack path

1. Attacker generates a specially malformed RAR archive targeting the audio filter code path
2. Malicious archive is delivered via download, package repository, or build context
3. Victim process invokes libarchive to extract or list contents of the archive
4. execute_filter_audio performs the out-of-bounds read/write
5. Resulting memory corruption may be leveraged for denial of service or code execution

How to detect it

Monitor process crash logs and sanitizer reports for faults originating in archive_read_support_format_rar.c; inspect build and extraction logs for unexpected failures when handling RAR files.

What your security team should do

• Immediately inventory all hosts and containers using libarchive or buildkit and prioritize upgrades
• Block untrusted RAR archives at ingress points until patches are applied
• Add version checks to CI/CD pipelines to prevent reintroduction of vulnerable builds