Cloudanix VulnDB

CVE-2024-57970

Medium · 4.0

CVSS

4.0

EPSS

0.3%

Published

Feb 16, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A library that reads archive files can crash when it encounters certain damaged or unusual archive contents.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Heap-based buffer over-read in header_gnu_longlink within archive_read_support_format_tar.c when processing TAR archives containing truncated GNU long linknames, leading to invalid memory access.

Why it matters to the business

Applications relying on libarchive for extracting or inspecting TAR files may crash or become unstable when handling specially crafted archives, disrupting backup, deployment, or data migration workflows.

How an attack unfolds

An attacker creates a TAR archive with a GNU long linkname that is truncated in the middle, then supplies the archive to any process using the vulnerable libarchive library; processing triggers the over-read in header parsing.

How to fix it

Upgrade libarchive to a version newer than 3.7.7 that resolves the truncation handling defect in archive_read_support_format_tar.c.

How to confirm the fix worked

Confirm the installed libarchive version exceeds 3.7.7; test archive ingestion with crafted long-linkname TAR files to verify absence of over-read behavior.

Typical attack path

  1. Generate a malformed TAR archive with a truncated GNU long linkname
  2. Deliver the archive to a target system or application
  3. Trigger archive processing through libarchive-dependent tools or libraries
  4. Induce heap buffer over-read resulting in denial of service

How to detect it

Monitor application logs and crash reports for segmentation faults or memory errors during TAR extraction; inspect inbound TAR files for anomalous GNU long linkname entries.

What your security team should do

  • Inventory all systems and containers using libarchive and prioritize updates
  • Apply vendor patches or rebuild dependent packages with the corrected library
  • Restrict untrusted TAR archive processing to isolated environments until patched

The record

libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:10 bsdtar 0 3.7.7-2.el10_0
AlmaLinux:10 libarchive 0 3.7.7-2.el10_0
AlmaLinux:10 libarchive-devel 0 3.7.7-2.el10_0
Alpine:v3.18 libarchive 0 3.7.9-r0
Alpine:v3.19 libarchive 0 3.7.9-r0
Alpine:v3.20 libarchive 0 3.7.9-r0
Alpine:v3.21 libarchive 0 3.7.9-r0
Alpine:v3.22 libarchive 0 3.7.9-r0
Chainguard libarchive 0 3.7.7-r2
Chainguard libarchive-dev 0 3.7.7-r2
Chainguard libarchive-doc 0 3.7.7-r2
Chainguard libarchive-tools 0 3.7.7-r2
Debian:11 libarchive 0 No fix
Debian:12 libarchive 0 No fix
Debian:13 libarchive 0 No fix
Julia LibArchive_jll 0 3.7.9+0
Ubuntu:20.04:LTS libarchive 0 No fix
Ubuntu:22.04:LTS libarchive 0 No fix
Ubuntu:24.04:LTS libarchive 0 No fix
Ubuntu:24.10 libarchive 0 No fix
Ubuntu:Pro:14.04:LTS libarchive 0 No fix
Ubuntu:Pro:16.04:LTS libarchive 0 No fix
Ubuntu:Pro:18.04:LTS libarchive 0 No fix
Wolfi libarchive 0 3.7.7-r2
Wolfi libarchive-dev 0 3.7.7-r2
Wolfi libarchive-doc 0 3.7.7-r2
Wolfi libarchive-tools 0 3.7.7-r2
openSUSE:Tumbleweed libarchive 0 3.7.7-2.1

Related vulnerabilities