Bug 2210921 (CVE-2023-30571) - CVE-2023-30571 libarchive: Race condition in multi-threaded use of archive_write_disk_header() on posix based systems
Summary: CVE-2023-30571 libarchive: Race condition in multi-threaded use of archive_wr...
Keywords:
Status: NEW
Alias: CVE-2023-30571
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2210922 2210923 2210924 2210925 2210926 2210927 2210928 2210929 2210930
Blocks: 2210884
TreeView+ depends on / blocked
 
Reported: 2023-05-30 04:18 UTC by Sandipan Roy
Modified: 2024-08-01 08:28 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description Sandipan Roy 2023-05-30 04:18:46 UTC
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.

https://groups.google.com/g/libarchive-announce
https://github.com/libarchive/libarchive/issues/1876

Comment 1 Sandipan Roy 2023-05-30 04:21:26 UTC
Created cmake3 tracking bugs for this issue:

Affects: epel-7 [bug 2210924]


Created libarchive tracking bugs for this issue:

Affects: fedora-37 [bug 2210925]
Affects: fedora-38 [bug 2210927]


Created mingw-libarchive tracking bugs for this issue:

Affects: fedora-37 [bug 2210926]
Affects: fedora-38 [bug 2210928]

Comment 3 Lukas Javorsky 2023-05-30 07:09:19 UTC
Hi,

In the description you've reported that this is affecting only libarchive-3.6.2 version.

However, we don't have this version released in any of our products.

Are older releases affected as well?

Comment 12 Lukas Javorsky 2023-07-31 10:16:11 UTC
Adding upstream's documentation for this CVE:

```
  The function `archive_write_disk_header()` is _not_ thread safe on
  POSIX machines and could lead to security issue resulting in world
  writeable directories.  Thus it must be mutexed by the calling code.
  This is due to calling `umask(oldumask = umask(0))`, which sets the
  umask for the whole process to 0 for a short time frame.
  In case other thread calls the same function in parallel, it might
  get interrupted by it and cause the executable to use umask=0 for the
  remaining execution.
  This will then lead to implicitely created directories to have 777
  permissions without sticky bit.
```


Note You need to log in before you can comment on or make changes to this bug.