CVE-2025-60753

Executive Summary

CVE-2025-60753 is a denial-of-service vulnerability in libarchive's bsdtar utility, affecting versions prior to 3.8.1. The flaw resides in the apply_substitution function within tar/subst.c, where crafted -s substitution rules can trigger unbounded memory allocation, leading to an out-of-memory crash. This vulnerability is exploitable locally or remotely if an attacker can supply a malicious archive file with specially crafted substitution rules. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity. The vendor has released a patch in version 3.8.1.

Supply Chain & Package Security

This vulnerability affects the libarchive library, which is a critical component in many Linux distributions and software packages. It is commonly used by package managers, backup tools, and archive utilities. Organizations should audit their software supply chain for dependencies on libarchive versions below 3.8.1 and update accordingly.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No vector provided)
• Attack Vector: Local/Network (requires crafted archive)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (user must process the archive with -s flag)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High
• Threat Level: Medium (Denial of Service)

Deep Dive & Mechanics

The vulnerability exists in the apply_substitution function in tar/subst.c. When bsdtar processes a substitution rule via the -s flag, it parses the rule and applies it to filenames during extraction. The function fails to properly validate the size of the resulting string after substitution, leading to unbounded memory allocation.

Specifically, the function uses realloc to expand a buffer for the substituted filename. If the substitution rule causes the filename to grow excessively (e.g., through repeated pattern matching), the buffer can be expanded without limit, consuming all available memory and causing a crash.

The vulnerable code path is triggered when:

1. A user provides a crafted archive file.
2. The archive contains filenames that match the substitution pattern.
3. The substitution rule causes exponential or unbounded growth of the filename string.

Vulnerable vs. Patched Code

Vulnerable Code (libarchive < 3.8.1):

// In tar/subst.c, apply_substitution function
static int
apply_substitution(struct bsdtar *bsdtar, const char *name, char **result)
{
    // ... pattern matching logic ...
    // No bounds checking on the resulting string length
    *result = realloc(*result, new_len);
    // ... copy substituted string ...
}

Patched Code (libarchive >= 3.8.1):

// In tar/subst.c, apply_substitution function
static int
apply_substitution(struct bsdtar *bsdtar, const char *name, char **result)
{
    // ... pattern matching logic ...
    // Added bounds checking to prevent unbounded allocation
    if (new_len > MAX_SUBSTITUTION_SIZE) {
        // Return error or truncate
        return -1;
    }
    *result = realloc(*result, new_len);
    // ... copy substituted string ...
}

The patch introduces a maximum size limit for the substituted filename, preventing memory exhaustion.

Exploitation & Lab Setup

Red Team

No public exploit code is available. However, a proof-of-concept can be crafted as follows:

1. Create a tar archive with a filename that matches a substitution pattern.
2. Use a substitution rule that causes the filename to grow exponentially (e.g., s/./&&/g).
3. Run bsdtar -x -s 's/./&&/g' -f malicious.tar.

Example:

# Create a tar archive with a single file named "a"
echo "test" > a
tar cf malicious.tar a

# Exploit with substitution rule that doubles the filename each time
bsdtar -x -s 's/./&&/g' -f malicious.tar

This will cause bsdtar to allocate memory for a filename that grows exponentially, eventually crashing due to OOM.

Blue Team

• Monitor for excessive memory usage by bsdtar processes.
• Detect unusual substitution rules in command-line arguments.
• Use process auditing to log all bsdtar invocations with -s flags.

Indicators of Compromise (IOCs)

• Process: bsdtar consuming excessive memory (>1GB)
• Command Line: bsdtar -s 's/./&&/g' or similar substitution patterns
• Logs: System logs showing OOM killer terminating bsdtar
• Network: No network indicators (local exploitation)

Detection Engineering

YARA Rule

rule CVE_2025_60753_bsdtar_OOM {
    meta:
        description = "Detects bsdtar processes with excessive memory allocation indicative of CVE-2025-60753 exploitation"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-60753"
    strings:
        $cmdline = /bsdtar.*-s\s+['\"]?s\/.\/&&\/g['\"]?/
    condition:
        $cmdline and (pe.imagesize > 1000000000 or for any process in (0..100) : (process_memory > 1000000000))
}

Sigma Rule

title: CVE-2025-60753 bsdtar Memory Exhaustion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects bsdtar processes with excessive memory usage or suspicious substitution rules
author: Valters IT
date: 2025-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/bsdtar'
        CommandLine|contains: '-s'
    condition: selection
falsepositives:
    - Legitimate use of substitution rules with small files
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-60753 bsdtar OOM Exploit Attempt"; flow:to_server; content:"bsdtar"; nocase; content:"-s"; distance:0; within:100; content:"s/./&&/g"; distance:0; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Upgrade libarchive to version 3.8.1 or later.
2. Workaround: Avoid using the -s flag with untrusted archives.
3. Mitigation: Implement resource limits for bsdtar processes (e.g., ulimit -v 500000).
4. Monitoring: Alert on bsdtar processes consuming >500MB memory.
5. Detection: Deploy YARA/Sigma rules to detect suspicious substitution patterns.

Valters IT
DevSecOps & Cyber Threat Intelligence