CVE-2024-48957

Executive Summary

CVE-2024-48957 is an out-of-bounds (OOB) access vulnerability in the execute_filter_audio function within archive_read_support_format_rar.c of libarchive, affecting versions prior to 3.7.5. The flaw allows a crafted RAR archive to cause src to move beyond dst, leading to a buffer over-read or write. This can be exploited by an attacker to cause a denial of service (DoS) or potentially achieve arbitrary code execution if the OOB access corrupts critical memory. The vulnerability is triggered during archive extraction, making it a risk for any application or service that processes untrusted RAR files using libarchive.

Supply Chain & Package Security

libarchive is a widely used library integrated into numerous Linux distributions, package managers, and security tools. This vulnerability affects the supply chain of any software that depends on libarchive for RAR extraction. Users of affected versions should treat this as a high-priority update to prevent exploitation via malicious archives.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector assigned by NVD)
• Attack Vector (AV): Local (requires user to open a crafted archive)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): Required (user must extract the archive)
• Scope (S): Unchanged
• Confidentiality (C): High (potential memory leak)
• Integrity (I): High (potential memory corruption)
• Availability (A): High (DoS via crash)
• Threat Level: High – Exploitation is possible with a crafted archive, and the impact includes potential code execution.

Deep Dive & Mechanics

The vulnerability resides in execute_filter_audio in archive_read_support_format_rar.c. This function processes audio filter data within RAR archives. The flaw occurs when the src pointer advances beyond the dst pointer during a memory copy or processing loop, leading to an out-of-bounds read or write. The root cause is insufficient bounds checking when handling specially crafted RAR filter parameters. An attacker can craft an RAR file with malicious filter data that causes src to exceed dst, reading or writing memory outside the intended buffer.

The vulnerable code path is triggered during the archive_read_next_header or archive_read_data calls when libarchive attempts to apply audio filters to decompressed data. The OOB access can corrupt adjacent heap memory, potentially leading to arbitrary code execution if the attacker controls the overwritten data.

Vulnerable vs. Patched Code

Vulnerable (libarchive < 3.7.5):

// In execute_filter_audio, the loop does not properly check bounds
while (src < end) {
    // ... processing that can increment src beyond dst
    if (some_condition) {
        src += delta;
    }
    // No check that src <= dst
}

Patched (libarchive 3.7.5):

// Added bounds check to prevent src from moving beyond dst
while (src < end && src <= dst) {
    // ... processing
    if (some_condition) {
        src += delta;
    }
    // Ensure src does not exceed dst
    if (src > dst) {
        // Handle error or break
        break;
    }
}

The patch adds a check src <= dst in the loop condition and an additional guard after incrementing src to prevent OOB access.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• libarchive version < 3.7.5
• Ability to craft a malicious RAR file with a manipulated audio filter block.

Exploitation Steps:

1. Create a specially crafted RAR archive using a tool like rar or a custom script that modifies the audio filter parameters.
2. The crafted archive should set the filter data such that during execute_filter_audio, the src pointer is incremented beyond dst.
3. Deliver the archive to the target (e.g., via email, download).
4. When the target extracts the archive using an affected libarchive version, the OOB access occurs, potentially crashing the application or executing arbitrary code.

Example Crafting (Conceptual):

# This is a conceptual example; actual exploitation requires deep RAR format knowledge
import struct

# Craft a minimal RAR file with a malicious audio filter block
# The filter block contains a delta value that causes src to exceed dst
# This is not a working exploit but illustrates the concept
def craft_malicious_rar():
    # ... build RAR headers and filter data
    pass

Blue Team (Defense & Detection)

Detection:

• Monitor for crashes in applications using libarchive (e.g., bsdtar, file-roller, unrar).
• Use memory analysis tools to detect OOB access patterns.
• Deploy file scanning solutions that can detect malformed RAR headers.

Prevention:

• Update libarchive to version 3.7.5 or later.
• Implement sandboxing for archive extraction processes.
• Use application whitelisting to prevent untrusted archives from being processed.

Indicators of Compromise (IOCs)

• File Hashes: (No specific hashes available; generic IOCs for crafted RAR files)
• Network: N/A (local exploitation)
• Process: Abnormal termination of processes using libarchive (e.g., bsdtar, unrar)
• Memory: Heap corruption patterns in libarchive's execute_filter_audio function
• Logs: Application crash logs referencing archive_read_support_format_rar.c and execute_filter_audio

Detection Engineering

YARA Rule

rule CVE_2024_48957_libarchive_OOB {
    meta:
        description = "Detects crafted RAR files exploiting CVE-2024-48957"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-48957"
    strings:
        $rar_magic = { 52 61 72 21 1A 07 00 } // RAR magic bytes
        $audio_filter = { 01 02 } // Example audio filter marker (conceptual)
    condition:
        $rar_magic at 0 and $audio_filter
}

Sigma Rule

title: CVE-2024-48957 Exploitation Attempt via Crafted RAR
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-48957 via malformed RAR files
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\bsdtar.exe'
            - '\unrar.exe'
            - '\7z.exe'
        CommandLine|contains: 'x ' # Extract command
    condition: selection
falsepositives:
    - Legitimate extraction of large archives
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-48957 Potential RAR Exploit"; flow:to_client,established; content:"|52 61 72 21 1A 07 00|"; depth:7; content:"|01 02|"; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade libarchive to version 3.7.5 or later.
2. Workaround: If upgrade is not possible, avoid extracting RAR files from untrusted sources.
3. Compensating Controls: Use a sandbox or container for archive extraction.
4. Monitoring: Enable logging for archive extraction processes and monitor for crashes.
5. Vendor Patch: Apply the official patch from libarchive (commit in 3.7.5).

Valters IT
Securing Digital Frontiers