Heap-Based Buffer Over-Read Vulnerability in libarchive: CVE-2024-57970
Summary
CVE-2024-57970: libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname. Affects libarchive across 2 version ranges.
< 3.7.9-r0
< b439d586f53911c84be5e380445a8a259e19114c
Fixed in 3.7.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a widely used library for reading and writing various archive formats, including tar, zip, and others. It provides a consistent API for handling archives and is utilized in many applications across different platforms. The library is known for its flexibility and ease of use, making it a popular choice for developers. However, it is susceptible to vulnerabilities, such as CVE-2024-57970, which can lead to security risks if not addressed promptly.
Vulnerability Detail
CVE-2024-57970 is a heap-based buffer over-read vulnerability found in libarchive versions up to 3.7.7. The issue arises in the function header_gnu_longlink within the file archive_read_support_format_tar.c. This vulnerability occurs when a TAR archive is processed, and the library mishandles truncation in the middle of a GNU long linkname. As a result, it can lead to unintended memory access, potentially allowing an attacker to read sensitive information from memory, which could be exploited for further attacks.
How To Fix
Minimum fixed version
3.7.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted TAR archives that may contain long linknames. This can help mitigate the risk until an official patch is applied.
Conclusion
CVE-2024-57970 is a significant vulnerability in libarchive that can lead to heap-based buffer over-reads, posing security risks. Users are advised to update to the latest version of libarchive to mitigate this issue and to avoid processing untrusted TAR archives as a temporary measure. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for libarchive →
FAQ
CVE-2024-57970 is a vulnerability in libarchive that allows for a heap-based buffer over-read, potentially exposing sensitive information.
libarchive versions up to 3.7.7 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If an immediate update is not possible, avoid processing untrusted TAR archives as a temporary workaround.
More information about libarchive can be found on its official website and documentation, which provide details on its features and usage.
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
