Bug 2290448 (CVE-2024-20696)

Summary:	CVE-2024-20696 libarchive: out-of-bounds access in copy_from_lzss_window_to_unp()
Product:	[Other] Security Response	Reporter:	Marco Benatto <mbenatto>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	agarcial, ahrabovs, aoconnor, aprice, asegurap, aucunnin, bdettelb, caswilli, dfreiber, dkuc, doconnor, drow, fjansen, hkataria, jburrell, jdobes, jmitchel, jsamir, jsherril, jtanner, jvasik, kaycoth, kholdawa, kshier, lcouzens, ljavorsk, luizcosta, mpierce, mskarbek, mstoklus, nweather, oezr, orabin, psegedy, rblanco, stcannon, sthirugn, teagle, vkrizan, vkumar, vmugicag, xiaoxwan, yguenane, zzhou
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the libarchive library. An out-of-bounds access in the copy_from_lzss_window_to_unp function in the libarchive/archive_read_support_format_rar.c file can be triggered due to an integer overflow when a specially crafted RAR archive is processed, causing a crash to the application linked to the library and resulting in a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2290449
Bug Blocks:	2290447

Description Marco Benatto 2024-06-04 20:25:43 UTC

Windows Libarchive Remote Code Execution Vulnerability.

References:
https://github.com/libarchive/libarchive/pull/2172
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20696
https://clearbluejar.github.io/posts/patch-tuesday-diffing-cve-2024-20696-windows-libarchive-rce/

Upstream patch:
https://github.com/libarchive/libarchive/commit/eac15e252010c1189a5c0f461364dbe2cd2a68b1

Comment 1 Marco Benatto 2024-06-04 20:25:58 UTC

Created libarchive tracking bugs for this issue:

Affects: fedora-all [bug 2290449]