CVE-2025-60753
📋 TL;DR
A vulnerability in libarchive's bsdtar allows attackers to cause denial of service through unbounded memory allocation when processing malicious substitution rules. This affects systems using vulnerable versions of libarchive/bsdtar for archive operations. The impact is limited to DoS rather than code execution.
💻 Affected Systems
- libarchive
- bsdtar
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash due to out-of-memory conditions, potentially affecting other services on the same host
Likely Case
bsdtar process crashes when processing malicious archives, disrupting archive operations
If Mitigated
Limited to bsdtar process termination without affecting other system components
🎯 Exploit Status
Exploitation requires ability to provide malicious archive files to bsdtar
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.8.1
Vendor Advisory: https://github.com/libarchive/libarchive/issues/2725
Restart Required: No
Instructions:
1. Update libarchive to version 3.8.1 or later
2. For package managers: Use system update commands (apt-get upgrade libarchive, yum update libarchive, brew upgrade libarchive)
3. For source builds: Download and compile from https://github.com/libarchive/libarchive/releases
🔧 Temporary Workarounds
Disable substitution processing
allAvoid using -s substitution flags when processing untrusted archives
# Do not use: bsdtar -x -s 'PATTERN/REPLACEMENT' archive.tar
# Use instead: bsdtar -x archive.tar
Resource limits
linuxSet memory limits on bsdtar processes to contain impact
ulimit -v 1048576 # Limit to 1GB virtual memory
systemd-run --scope -p MemoryLimit=1G bsdtar ...
🧯 If You Can't Patch
- Avoid processing untrusted archives with bsdtar
- Use alternative archive tools for processing archives from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check libarchive version: bsdtar --version | grep 'libarchive'Check Version:
bsdtar --version | grep 'libarchive'Verify Fix Applied:
Verify version is 3.8.1 or later: bsdtar --version | grep -E 'libarchive 3\.(8\.[1-9]|[9-9]\.[0-9])'📡 Detection & Monitoring
Log Indicators:
- bsdtar process crashes with out-of-memory errors
- High memory usage by bsdtar processes
- Kernel OOM killer terminating bsdtar
Network Indicators:
- Large archive downloads followed by process crashes
SIEM Query:
process.name="bsdtar" AND (event.action="process_crash" OR memory.usage>90%)