Cloudanix VulnDB

CVE-2024-48958

None

CVSS

—

EPSS

0.6%

Published

Oct 10, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a common file-handling library could let attackers crash programs or potentially take over systems by getting users to open a specially made archive file.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Full Compromise
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability permits out-of-bounds memory access during RAR archive parsing in the execute_filter_delta function of archive_read_support_format_rar.c because the src pointer can advance beyond dst.

Why it matters to the business

Applications relying on libarchive to extract or inspect RAR archives risk crashes or potential arbitrary code execution when handling malicious files, which can disrupt operations, enable data theft, or lead to full system compromise in environments processing untrusted archives.

How an attack unfolds

An attacker crafts a malformed RAR archive that manipulates the delta filter metadata so src exceeds dst bounds inside execute_filter_delta; when a vulnerable application opens the archive, libarchive performs the out-of-bounds read or write, which may be leveraged for memory corruption primitives leading to code execution.

How to fix it

Upgrade libarchive to version 3.7.5 or newer by applying commit 12ecf8418ab3595d66cdea1abadcea8b6a9d288b; rebuild and redeploy all dependent applications after the update.

How to confirm the fix worked

Confirm the running libarchive version reports 3.7.5 or later, then execute unit tests that feed both well-formed and boundary-case RAR archives through the library to ensure no crashes or sanitizer violations occur.

Typical attack path

  1. Create a specially crafted RAR archive exploiting the execute_filter_delta pointer arithmetic flaw
  2. Deliver the archive via email, download, or shared storage to a target system
  3. Induce the target application or service to invoke libarchive on the file
  4. Trigger the out-of-bounds access during RAR format handling to achieve memory corruption

How to detect it

Review application and system logs for unexpected crashes or segmentation faults during RAR archive processing; correlate process terminations with recent file-open events involving .rar files.

What your security team should do

  • Immediately update all instances of libarchive to the fixed commit or 3.7.5 release
  • Inventory and replace any statically linked or vendored copies of the library
  • Add archive-file sandboxing or content-type restrictions until patching is complete

The record

execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.

Affected packages

Ecosystem Package Introduced Fixed
Alpine:v3.21 libarchive 0 3.7.5-r0
Alpine:v3.22 libarchive 0 3.7.5-r0
Debian:12 libarchive 0 No fix
Debian:13 libarchive 0 No fix
Debian:14 libarchive 0 3.7.2-2.1
Mageia:9 libarchive 0 3.6.2-5.2.mga9
SUSE:Linux Enterprise Module for Basesystem 15 SP6 libarchive 0 3.7.2-150600.3.9.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 libarchive 0 3.7.2-150600.3.9.1
Ubuntu:20.04:LTS libarchive 0 3.4.0-2ubuntu1.3
Ubuntu:22.04:LTS libarchive 0 3.6.0-1ubuntu1.2
Ubuntu:24.04:LTS libarchive 0 3.7.2-2ubuntu0.2
Ubuntu:24.10 libarchive 0 3.7.4-1
Ubuntu:Pro:14.04:LTS libarchive 0 3.1.2-7ubuntu2.8+esm3
Ubuntu:Pro:16.04:LTS libarchive 0 3.1.2-11ubuntu0.16.04.8+esm1
Ubuntu:Pro:18.04:LTS libarchive 0 3.2.2-3.1ubuntu0.7+esm1
openSUSE:Leap 15.6 libarchive 0 3.7.2-150600.3.9.1

Related vulnerabilities