CVE-2024-48615
📋 TL;DR
A null pointer dereference vulnerability in libarchive 3.7.6 and earlier allows attackers to cause denial of service (crash) when processing specially crafted tar archives. This affects systems using bsdtar or applications that link against vulnerable libarchive versions. The vulnerability occurs in the header_pax_extension function during archive parsing.
💻 Affected Systems
- libarchive
- bsdtar
- applications using libarchive library
📦 What is this software?
Libarchive by Libarchive
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through application crashes, potentially leading to data loss or system instability if the process handles critical operations.
Likely Case
Denial of service through application crashes when processing malicious tar archives, requiring manual intervention to restart affected services.
If Mitigated
Minimal impact with proper input validation and sandboxing; crashes would be contained to non-critical processes.
🎯 Exploit Status
Proof-of-concept crash test available in referenced GitHub repository. Exploitation requires ability to supply malicious tar archives to vulnerable applications.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libarchive 3.7.7 or later
Vendor Advisory: https://github.com/libarchive/libarchive/releases
Restart Required: No
Instructions:
1. Download latest libarchive from official repository. 2. Compile and install new version. 3. Recompile any applications using libarchive with updated library. 4. Update package manager if using distribution packages.
🔧 Temporary Workarounds
Input validation for tar archives
allImplement strict validation of tar archives before processing, rejecting suspicious or malformed files.
🧯 If You Can't Patch
- Restrict tar archive processing to trusted sources only
- Run vulnerable applications in sandboxed/containerized environments with limited privileges
🔍 How to Verify
Check if Vulnerable:
Check libarchive version: bsdtar --version or check library version with package manager (e.g., dpkg -l libarchive*).Check Version:
bsdtar --version | grep libarchive || dpkg -l libarchive* | grep ^ii || rpm -qa | grep libarchiveVerify Fix Applied:
Verify installed libarchive version is 3.7.7 or later and test with known malicious tar archives from PoC repository.📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults during tar processing
- Unexpected process termination when handling archive files
Network Indicators:
- Unusual tar archive uploads to web applications
- Multiple failed archive processing attempts
SIEM Query:
process_name:bsdtar AND event_type:crash OR process_name contains archive AND exit_code:139