libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file. References: https://github.com/libarchive/libarchive/pull/1120/commits/65a23f5dbee4497064e9bb467f81138a62b0dae1 https://github.com/libarchive/libarchive/pull/1120
Created libarchive tracking bugs for this issue: Affects: fedora-all [bug 1672900]
Created libarchive tracking bugs for this issue: Affects: epel-6 [bug 1672901]
Simple to reproduce. ``` ==7394== Use of uninitialised value of size 8 ==7394== at 0x5E2A119: crc32_z (in /usr/lib64/libz.so.1.2.11) ==7394== by 0x4E732EE: header_bytes (archive_read_support_format_7zip.c:2809) ==7394== by 0x4E75012: read_Header (archive_read_support_format_7zip.c:2573) ==7394== by 0x4E75012: slurp_central_directory (archive_read_support_format_7zip.c:2926) ==7394== by 0x4E75012: archive_read_format_7zip_read_header (archive_read_support_format_7zip.c:638) ==7394== by 0x4E641FD: _archive_read_next_header2 (archive_read.c:648) ==7394== by 0x4E64302: _archive_read_next_header (archive_read.c:686) ==7394== by 0x10FC15: read_archive (read.c:260) ==7394== by 0x11037A: tar_mode_x (read.c:112) ==7394== by 0x10E5A0: main (bsdtar.c:864) ==7394== ==7394== Use of uninitialised value of size 8 ==7394== at 0x5E2A127: crc32_z (in /usr/lib64/libz.so.1.2.11) ==7394== by 0x4E732EE: header_bytes (archive_read_support_format_7zip.c:2809) ==7394== by 0x4E75012: read_Header (archive_read_support_format_7zip.c:2573) ==7394== by 0x4E75012: slurp_central_directory (archive_read_support_format_7zip.c:2926) ==7394== by 0x4E75012: archive_read_format_7zip_read_header (archive_read_support_format_7zip.c:638) ==7394== by 0x4E641FD: _archive_read_next_header2 (archive_read.c:648) ==7394== by 0x4E64302: _archive_read_next_header (archive_read.c:686) ==7394== by 0x10FC15: read_archive (read.c:260) ==7394== by 0x11037A: tar_mode_x (read.c:112) ==7394== by 0x10E5A0: main (bsdtar.c:864) ``` Looks to run off the end of a buffer in crc32_little: ``` #0 0x00007ffff6bd614f in crc32_little (len=1442449, buf=<optimized out>, crc=<optimized out>) at crc32.c:283 #1 crc32_z (crc=<optimized out>, buf=buf@entry=0x55555577b8a3 ";\r\231Ē\377\200\212\265\004+D\367\364\265\231Ē\377\200\212\265\004+D\367\364\265̀\314tH\241\316\372% \347\301\016", len=len@entry=1442450) at crc32.c:220 #2 0x00007ffff6bd624b in crc32 (crc=<optimized out>, buf=buf@entry=0x55555577b8a3 ";\r\231Ē\377\200\212\265\004+D\367\364\265\231Ē\377\200\212\265\004+D\367\364\265̀\314tH\241\316\372% \347\301\016", len=len@entry=1442450) at crc32.c:242 #3 0x00007ffff7b502ef in header_bytes (a=a@entry=0x55555576ccf0, rbytes=rbytes@entry=1442450) at libarchive/archive_read_support_format_7zip.c:2809 ``` etc.
Unclear when 7zip support was added, but it does not appear to be in the Red Hat Enterprise Linux 6 release, hence not vulnerable.
Created mingw-libarchive tracking bugs for this issue: Affects: fedora-all [bug 1674057]
Statement: This vulnerability is present in the libarchive package included in Red Hat Virtualization Hypervisor, however it is never exposed to archives created by attackers or users, so the vulnerability can not be exploited.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2298 https://access.redhat.com/errata/RHSA-2019:2298
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-1000019
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:3698 https://access.redhat.com/errata/RHSA-2019:3698