REDHAT-BUG-2554209: Low severity Libarchive libarchive vulnerability
Summary: The flaw occurs when the source buffer passed to archiveentrycopymacmetadata() points to the internal Mac metadata buffer of the same archiveentry object. The function frees the internal buffer before copying from it, causing a UAF read during memcpy().
Requirements to exploit: An attacker need ability of reading and writing to a program using vulnarable libarchive entry API
Component affected: https://github.com/libarchive/libarchive
Version affected: Commit hash 4840347 and previous versions. I didn't try on any release version.
Patch Available: Yes
Version fixed: No release version has been confirmed fixed the flaw.But have a patch in upstream by PR #3318： https://github.com/libarchive/libarchive/pull/3318
Upstream coordination: Upstream was notified publicly through the following GitHub issue: https://github.com/libarchive/libarchive/issues/3313 And a fix was submitted and merged: https://github.com/libarchive/libarchive/pull/3318
Impact: A successful exploitation will make the program read wrong data from a freed buffer and then have logic problem. In addition, it probably can benefit chunk metadata leak for potential control flow hijack.
Embargo: No
Suggested public date: N/A, since the issue is already public.
Acknowledgement: Mr.Xin
Steps to reproduce: 1. Build the POC.c (source file is in the attachments): /usr/bin/clang -O1 -g \ -fsanitize=address,undefined -fno-omit-frame-pointer \ -I/path/to/libarchive/libarchive \ /path/to/POC.c \ /path/to/libarchive/LibBuilds/libarchive/libarchive.a \ -lz -lbz2 -llzma -lzstd -lcrypto -lxml2 -lssl \ -licui18n -licuuc -licudata -lm -lresolv \ -o /output/path/POCExecutor
2. Run PoC LLVMSYMBOLIZERBIN=/path/to/llvm-symbolizer ASANOPTIONS="detectleaks=0:haltonerror=1:abortonerror=1:symbolize=1:externalsymbolizerpath=${LLVMSYMBOLIZERBIN}" \ UBSANOPTIONS=haltonerror=1:printstacktrace=1 \ /output/path/POCExecutor
Original report: https://github.com/libarchive/libarchive/issues/3313
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libarchiveto a version that resolves this vulnerability.Patch PR #3318
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs the ability to read from and write to a program that uses the vulnerable libarchive entry API. Exploitation depends on causing the source buffer supplied to the affected function to reference the same archive_entry object's internal Mac metadata buffer.
How can I determine whether my build is affected?
The affected upstream range includes commit 4840347 and earlier. No affected or fixed release version has been confirmed, so release-version checks alone cannot establish whether a deployed package contains the flaw.
What should I do if I cannot immediately move to a fixed release?
Use the upstream patch submitted and merged in PR #3318, if it can be applied to the deployed source or vendor build. There is no confirmed fixed release version in the provided information.