REDHAT-BUG-2554209: Low severity Libarchive libarchive vulnerability

Summary: The flaw occurs when the source buffer passed to archiveentrycopymacmetadata() points to the internal Mac metadata buffer of the same archiveentry object. The function frees the internal buffer before copying from it, causing a UAF read during memcpy().

Requirements to exploit: An attacker need ability of reading and writing to a program using vulnarable libarchive entry API

Component affected: https://github.com/libarchive/libarchive

Version affected: Commit hash 4840347 and previous versions. I didn't try on any release version.

Patch Available: Yes

Version fixed: No release version has been confirmed fixed the flaw.But have a patch in upstream by PR #3318： https://github.com/libarchive/libarchive/pull/3318

Upstream coordination: Upstream was notified publicly through the following GitHub issue: https://github.com/libarchive/libarchive/issues/3313 And a fix was submitted and merged: https://github.com/libarchive/libarchive/pull/3318

Impact: A successful exploitation will make the program read wrong data from a freed buffer and then have logic problem. In addition, it probably can benefit chunk metadata leak for potential control flow hijack.

Embargo: No

Suggested public date: N/A, since the issue is already public.

Acknowledgement: Mr.Xin

Steps to reproduce: 1. Build the POC.c (source file is in the attachments): /usr/bin/clang -O1 -g \ -fsanitize=address,undefined -fno-omit-frame-pointer \ -I/path/to/libarchive/libarchive \ /path/to/POC.c \ /path/to/libarchive/LibBuilds/libarchive/libarchive.a \ -lz -lbz2 -llzma -lzstd -lcrypto -lxml2 -lssl \ -licui18n -licuuc -licudata -lm -lresolv \ -o /output/path/POCExecutor

2. Run PoC LLVMSYMBOLIZERBIN=/path/to/llvm-symbolizer ASANOPTIONS="detectleaks=0:haltonerror=1:abortonerror=1:symbolize=1:externalsymbolizerpath=${LLVMSYMBOLIZERBIN}" \ UBSANOPTIONS=haltonerror=1:printstacktrace=1 \ /output/path/POCExecutor

Original report: https://github.com/libarchive/libarchive/issues/3313