CVE-2025-25724

Executive Summary

CVE-2025-25724 is a denial-of-service vulnerability in libarchive, a widely used library for reading and writing streaming archives. The flaw resides in the list_item_verbose function within tar/util.c. When processing a crafted TAR archive with a verbose level of 2, the function fails to check the return value of strftime. This can lead to a buffer overflow or truncation, potentially causing a crash or other unspecified impacts. The vulnerability is triggered locally by a user extracting a malicious archive. The CVSS score is 4.0 (Medium), and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the libarchive library, which is a critical component in many Linux distributions and software packages. It is not an NPM, PyPI, Go, or Ruby package, but its widespread use in system utilities (e.g., tar, bsdtar) and backup software makes it a high-value target for supply chain attacks. An attacker could craft a malicious archive that, when processed by any application using libarchive, causes a denial of service. The lack of a patch increases the risk for all downstream consumers.

CVSS Breakdown & Threat Level

• CVSS Score: 4.0 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must extract the malicious archive.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – The vulnerability can cause a complete denial of service.

Threat Level: Medium. The vulnerability requires user interaction and local access, but it can be exploited to crash applications or the system. The lack of a patch and the widespread use of libarchive elevate the risk.

Deep Dive & Mechanics

The vulnerability is in the list_item_verbose function in tar/util.c. When libarchive's tar command is run with verbose level 2 (-vv), it calls strftime to format timestamps. The function uses a fixed 100-byte buffer for the formatted string. However, strftime can return a value greater than the buffer size, especially when a custom locale is used that produces longer date strings. The code does not check the return value of strftime before using the buffer, leading to a potential buffer overflow or truncation.

Root Cause: Missing return value check for strftime in list_item_verbose.

Impact: A crafted TAR archive with specific timestamps and a custom locale can cause strftime to write beyond the 100-byte buffer, leading to a crash (denial of service) or potentially other unspecified impacts.

Affected Code Path:

1. User runs tar -xvvf malicious.tar (verbose level 2).
2. list_item_verbose is called for each entry.
3. strftime is called with a 100-byte buffer.
4. If the formatted date string exceeds 100 bytes, the buffer overflows.

Vulnerable vs. Patched Code

Vulnerable Code (libarchive <= 3.7.7):

// tar/util.c
static void
list_item_verbose(struct archive *a, struct archive_entry *entry)
{
    char buff[100];
    const char *fmt;

    // ... (other code)

    fmt = "%b %e %H:%M";
    strftime(buff, sizeof(buff), fmt, localtime_r(&tim, &tm));
    // No check on return value of strftime
    // buff may be truncated or overflowed
    // ... (use buff)
}

Patched Code (Hypothetical):

static void
list_item_verbose(struct archive *a, struct archive_entry *entry)
{
    char buff[100];
    const char *fmt;
    size_t ret;

    // ... (other code)

    fmt = "%b %e %H:%M";
    ret = strftime(buff, sizeof(buff), fmt, localtime_r(&tim, &tm));
    if (ret == 0 || ret >= sizeof(buff)) {
        // Handle error: buffer too small or strftime failed
        // Fallback to a safe default or skip the entry
        snprintf(buff, sizeof(buff), "???");
    }
    // ... (use buff safely)
}

Key Difference: The patched code checks the return value of strftime and handles the case where the buffer is insufficient, preventing the overflow.

Exploitation & Lab Setup

Red Team

Prerequisites:

• libarchive <= 3.7.7 installed.
• Ability to create a TAR archive with custom timestamps and a locale that produces long date strings.

Exploitation Steps:

1. Craft a malicious TAR archive: Use a tool like pax or a custom script to create a TAR file with entries that have timestamps causing strftime to produce a string longer than 100 bytes. This typically requires a locale with very long month or day names (e.g., some locales have month names exceeding 20 characters).
2. Set the locale: Ensure the victim's system is using a locale that produces long date strings (e.g., LC_TIME=zh_CN.utf8 or a custom locale).
3. Trigger the vulnerability: Run tar -xvvf malicious.tar on the target system.
4. Observe the crash: The application may crash due to a buffer overflow, causing a denial of service.

Example (Conceptual):

# Create a malicious TAR archive (requires custom tooling)
# The archive should have entries with timestamps that cause strftime to overflow
# For example, using a locale with very long month names
LC_TIME=zh_CN.utf8 tar -xvvf malicious.tar

Note: No public exploit code is available. This is a conceptual description.

Blue Team

Detection:

• Monitor for crashes of tar or applications using libarchive.
• Look for unusual locale settings when tar is executed.
• Use file integrity monitoring to detect the presence of crafted TAR archives.

Prevention:

• Restrict the use of verbose level 2 (-vv) in automated scripts.
• Use a patched version of libarchive when available.
• Implement input validation for archive files before extraction.

Hunting:

• Search for logs indicating tar crashes or segmentation faults.
• Analyze TAR archives for unusual timestamps or metadata.

Indicators of Compromise (IOCs)

• File Hashes: No specific hashes available.
• Network Indicators: None (local vulnerability).
• System Indicators:
  • Crash logs for tar or bsdtar with segmentation faults.
  • Unusual locale environment variables (e.g., LC_TIME set to a non-standard value).
  • Presence of TAR archives with timestamps that cause strftime to overflow.
• Behavioral Indicators:
  • Repeated crashes of archive extraction tools.
  • High memory or CPU usage during extraction.

Detection Engineering

YARA Rule

rule CVE_2025_25724_libarchive_strftime_overflow {
    meta:
        description = "Detects libarchive binaries vulnerable to CVE-2025-25724"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-25724"
        hash = "unknown"
    strings:
        $strftime_call = { E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 7D ?? } // call strftime; test eax,eax; je ...
        $buffer_size = { 64 00 00 00 } // 100 in hex (0x64)
    condition:
        $strftime_call and $buffer_size
}

Sigma Rule

title: CVE-2025-25724 - libarchive strftime Overflow Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2025-25724 via tar crashes
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/tar'
        CommandLine|contains: '-vv'
    condition: selection
falsepositives:
    - Legitimate use of verbose tar extraction
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-25724 - libarchive strftime Overflow Attempt"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; offset:0; classtype:attempted-dos; sid:1000001; rev:1;)

Note: This Suricata rule is a placeholder as the vulnerability is local and not network-triggered. Network detection is not applicable.

Remediation & Mitigation

Immediate Actions:

1. Monitor for patches: Track libarchive releases for a fix.
2. Restrict verbose usage: Avoid using -vv (verbose level 2) in automated scripts or user-facing tools.
3. Input validation: Validate TAR archives before extraction, especially if they come from untrusted sources.

Long-term Fix:

• Apply the official patch from libarchive when released.
• Upgrade to a patched version (e.g., > 3.7.7).

Workarounds:

• Use a different archive tool (e.g., GNU tar) if libarchive is not required.
• Set a safe locale (e.g., LC_TIME=C) when using tar with verbose level 2.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. All information is provided for educational and defensive purposes only.