REDHAT-BUG-2144972: Null Pointer Dereference

Published Nov 22, 2022

Updated

In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference or, in some cases, even arbitrary code execution.

Upstream patch: https://github.com/libarchive/libarchive/commit/fd180c36036df7181a64931264732a10ad8cd024

Affected Software

1 affected component

Libarchive libarchive

Event History

Nov 22, 2022

Data Sourced

via Red Hat·08:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2144972?

The severity of REDHAT-BUG-2144972 is critical due to the potential for arbitrary code execution resulting from a NULL pointer dereference.

How do I fix REDHAT-BUG-2144972?

To fix REDHAT-BUG-2144972, update to the latest version of libarchive where the error handling for the calloc function is properly implemented.

What software is affected by REDHAT-BUG-2144972?

The affected software for REDHAT-BUG-2144972 is libarchive version 3.6.1.

What type of vulnerability is REDHAT-BUG-2144972?

REDHAT-BUG-2144972 is a NULL pointer dereference vulnerability that may lead to arbitrary code execution.

Is there a known exploit for REDHAT-BUG-2144972?

As of now, there are no publicly known exploits specifically targeting REDHAT-BUG-2144972.