CVE-2024-48958

Executive Summary

CVE-2024-48958 is a critical out-of-bounds read vulnerability in the execute_filter_delta function within archive_read_support_format_rar.c of libarchive versions prior to 3.7.5. The flaw allows a crafted RAR archive to cause src to move beyond dst, leading to out-of-bounds memory access. Successful exploitation could result in information disclosure, denial of service, or potentially arbitrary code execution. The vulnerability is triggered when processing a maliciously crafted archive file, requiring user interaction to open the file. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

libarchive is a widely used library for reading and writing various archive formats. It is a dependency in numerous operating systems (Linux, macOS, BSD), package managers, and software applications. A vulnerability in libarchive can propagate through the software supply chain, affecting any application that uses the library to process RAR archives. Users are advised to update to libarchive 3.7.5 or apply the vendor patch immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector (AV): Local (L) – Requires the attacker to have local access or trick a user into opening a malicious file.
• Attack Complexity (AC): Low (L) – No special conditions required beyond the crafted file.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must open the malicious archive.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Potential memory disclosure.
• Integrity (I): High (H) – Potential memory corruption.
• Availability (A): High (H) – Potential crash or denial of service.

Threat Level: High. While no active exploitation is reported, the ease of triggering the vulnerability via a crafted archive file makes it a significant risk for systems that process untrusted RAR archives.

Deep Dive & Mechanics

The vulnerability resides in the execute_filter_delta function in archive_read_support_format_rar.c. This function is responsible for applying delta filters during RAR decompression. The flaw occurs when the src pointer, which reads data from the input buffer, advances beyond the dst pointer, which writes to the output buffer. This out-of-bounds access can lead to reading or writing memory outside the intended buffer boundaries.

The root cause is insufficient bounds checking when calculating the delta offset. A specially crafted RAR archive can manipulate the delta parameters to cause src to exceed dst, resulting in an out-of-bounds read or write. The vulnerability is triggered during the decompression phase when the archive is being read.

Vulnerable vs. Patched Code

Vulnerable Code (libarchive < 3.7.5):

static int
execute_filter_delta(struct archive_read *a, struct rar_filter *filter,
    struct rar_virtual_machine *vm)
{
    // ... setup code ...
    while (length > 0) {
        // Vulnerable: no check that src does not exceed dst
        *dst++ = *src++ + delta;
        length--;
    }
    // ...
}

Patched Code (libarchive 3.7.5):

static int
execute_filter_delta(struct archive_read *a, struct rar_filter *filter,
    struct rar_virtual_machine *vm)
{
    // ... setup code ...
    while (length > 0) {
        // Patched: added bounds check
        if (src >= dst) {
            archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
                "Delta filter: src beyond dst");
            return ARCHIVE_FATAL;
        }
        *dst++ = *src++ + delta;
        length--;
    }
    // ...
}

The patch adds a check to ensure src does not exceed dst before performing the delta operation, preventing out-of-bounds access.

Exploitation & Lab Setup

Red Team

No public exploit code is available for CVE-2024-48958. However, a proof-of-concept can be developed by crafting a RAR archive with manipulated delta filter parameters. The following steps outline a potential exploitation approach:

1. Craft a Malicious RAR Archive: Use a hex editor or custom script to create a RAR file with a delta filter that causes src to exceed dst.
2. Trigger the Vulnerability: The victim must open the crafted archive using an application that relies on libarchive (e.g., bsdtar, file-roller, or any software using libarchive).
3. Achieve Impact: Depending on memory layout, the out-of-bounds access could lead to information disclosure (reading sensitive memory) or a crash (denial of service). In some cases, it may be possible to achieve arbitrary code execution.

Example Lab Setup:

• Target: Ubuntu 22.04 with libarchive 3.6.0
• Attacker: Kali Linux
• Steps:
  1. Create a malicious RAR file using a custom script.
  2. Transfer the file to the target.
  3. Execute bsdtar xf malicious.rar on the target.
  4. Observe crash or memory corruption.

Blue Team

To detect exploitation attempts:

1. Monitor for Crashes: Applications using libarchive may crash when processing malicious RAR files. Monitor system logs for segfaults or aborts.
2. File Integrity Monitoring: Watch for unexpected RAR files in sensitive directories.
3. Network Monitoring: If the archive is downloaded, monitor for suspicious file transfers.
4. Endpoint Detection: Use EDR solutions to detect abnormal memory access patterns.

Indicators of Compromise (IOCs)

• File Hashes: (No known malicious samples yet)
• File Names: *.rar files with unusual sizes or metadata.
• Process Behavior: bsdtar, file-roller, or other libarchive-based processes crashing with SIGSEGV.
• Memory Patterns: Out-of-bounds reads in the execute_filter_delta function.
• Network: Downloads of RAR files from untrusted sources.

Detection Engineering

YARA Rule

rule CVE_2024_48958_libarchive_delta_oob {
    meta:
        description = "Detects crafted RAR files exploiting CVE-2024-48958"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-48958"
    strings:
        $delta_filter = { 44 45 4c 54 41 } // "DELTA" in hex
        $rar_magic = { 52 61 72 21 1a 07 00 } // RAR magic bytes
    condition:
        $rar_magic at 0 and $delta_filter
}

Sigma Rule

title: CVE-2024-48958 Exploitation Attempt via libarchive
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects crashes or abnormal behavior in libarchive-based processes
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/bsdtar'
            - '/file-roller'
            - '/libarchive.so'
        CommandLine|contains: '.rar'
    condition: selection
falsepositives:
    - Legitimate RAR file processing
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-48958 libarchive RAR delta OOB"; flow:to_server,established; content:"|52 61 72 21 1a 07 00|"; depth:7; content:"|44 45 4c 54 41|"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Update libarchive: Upgrade to version 3.7.5 or later immediately.
2. Patch Management: Apply vendor patches for all affected systems.
3. Input Validation: Do not process RAR archives from untrusted sources.
4. Sandboxing: Use sandboxed environments to process archive files.
5. Monitoring: Implement detection rules (YARA, Sigma, Suricata) to identify exploitation attempts.
6. Least Privilege: Run applications processing archives with minimal privileges.

Valters IT
DevSecOps & Cyber Threat Intelligence