Cloudanix VulnDB

CVE-2025-1632

None

CVSS

—

EPSS

0.3%

Published

Feb 24, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in a common file-extraction tool can make programs crash when they try to list the contents of certain archive files on the same computer.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
No Fix Yet
Effort
Other
Patch risk
Other

What it actually does

Null pointer dereference in the list function of bsdunzip.c within libarchive up to 3.7.7 causes a crash when processing crafted input on the local host.

Why it matters to the business

Local denial-of-service against systems using the affected library through a single dependent package reduces availability of archive-handling operations with minimal external exposure risk due to one downstream dependent.

How an attack unfolds

An attacker with local access supplies a specially crafted archive file that reaches the vulnerable list function in bsdunzip.c, triggering the null pointer dereference; the public exploit may be adapted by local users or malware already present on the host.

How to fix it

Upgrade the salt package to version 2015.8.13 or later; rebuild or replace any statically linked libarchive instances with a patched release that resolves the null dereference in bsdunzip.c.

How to confirm the fix worked

Confirm the installed salt version meets or exceeds 2015.8.13, run regression tests with archive inputs that previously triggered the list function, and verify absence of null dereference crashes under controlled local execution.

Typical attack path

  1. Obtain local shell or process execution on the target host
  2. Place or supply a malicious archive file that exercises the list function
  3. Trigger processing via command-line tool or application call
  4. Observe crash or service interruption

How to detect it

Review local process crash logs and application error reports for segmentation faults or null dereference entries originating from bsdunzip or libarchive when archive listing operations occur; correlate with file creation or execution events involving untrusted archives.

What your security team should do

  • Prioritize upgrade of salt to 2015.8.13 across all environments within standard change windows given low EPSS and local-only attack vector
  • Audit for direct or transitive use of libarchive versions up to 3.7.7
  • Add local fuzzing or archive-processing tests to CI pipelines
  • Monitor vendor advisories for libarchive updates even when no KEV entry exists

The record

A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages

Ecosystem Package Introduced Fixed
Alpine:v3.18 libarchive 0 3.7.9-r0
Alpine:v3.19 libarchive 0 3.7.9-r0
Alpine:v3.20 libarchive 0 3.7.9-r0
Alpine:v3.21 libarchive 0 3.7.9-r0
Alpine:v3.22 libarchive 0 3.7.9-r0
Chainguard libarchive 0 3.7.7-r2
Chainguard libarchive-dev 0 3.7.7-r2
Chainguard libarchive-doc 0 3.7.7-r2
Chainguard libarchive-tools 0 3.7.7-r2
Debian:11 libarchive 0 No fix
Debian:12 libarchive 0 No fix
Debian:13 libarchive 0 No fix
Debian:14 libarchive 0 3.7.4-2
SUSE:Linux Enterprise Module for Basesystem 15 SP6 libarchive 0 3.7.2-150600.3.12.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 libarchive 0 3.7.2-150600.3.12.1
Wolfi libarchive 0 3.7.7-r2
Wolfi libarchive-dev 0 3.7.7-r2
Wolfi libarchive-doc 0 3.7.7-r2
Wolfi libarchive-tools 0 3.7.7-r2
openSUSE:Leap 15.6 libarchive 0 3.7.2-150600.3.12.1
openSUSE:Tumbleweed libarchive 0 3.7.7-3.1

Related vulnerabilities