Bug 2144972 (CVE-2022-36227) - CVE-2022-36227 libarchive: NULL pointer dereference in archive_write.c
Summary: CVE-2022-36227 libarchive: NULL pointer dereference in archive_write.c
Keywords:
Status: NEW
Alias: CVE-2022-36227
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2144973 2144975 2147362 2147363 2144974
Blocks: 2144976
TreeView+ depends on / blocked
 
Reported: 2022-11-22 20:01 UTC by Pedro Sampaio
Modified: 2022-12-15 17:24 UTC (History)
42 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in libarchive. A missing check of the return value of the calloc function can cause a NULL pointer dereference in an out-of-memory condition or when a memory allocation limit is reached, resulting in the program linked with libarchive to crash.
Clone Of:
Environment:
Last Closed:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Pedro Sampaio 2022-11-22 20:01:01 UTC 
In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference or, in some cases, even arbitrary code execution.

Upstream patch:
https://github.com/libarchive/libarchive/commit/fd180c36036df7181a64931264732a10ad8cd024
Comment 1 Pedro Sampaio 2022-11-22 20:01:25 UTC 
Created cmake3 tracking bugs for this issue:

Affects: epel-all [bug 2144973]


Created libarchive tracking bugs for this issue:

Affects: fedora-all [bug 2144974]


Created mingw-libarchive tracking bugs for this issue:

Affects: fedora-all [bug 2144975]
Comment 2 Guilherme de Almeida Suckevicz 2022-11-23 19:08:33 UTC 
Reference:
https://github.com/libarchive/libarchive/issues/1754
Note You need to log in before you can comment on or make changes to this bug.