CVE-2024-37407: Libarchive Buffer Overflow Vulnerability

CVE-2024-37407 Overview

CVE-2024-37407 is an out-of-bounds read vulnerability affecting Libarchive versions prior to 3.7.4. The vulnerability occurs when processing ZIP archives containing files with empty names while the mac-ext (Mac extension) functionality is enabled. This flaw exists in the slurp_central_directory function within archive_read_support_format_zip.c, where improper boundary checking allows memory access beyond allocated buffers.

Critical Impact

This vulnerability enables network-based attackers to trigger out-of-bounds memory access without authentication, potentially resulting in information disclosure or denial of service conditions on systems processing maliciously crafted ZIP archives.

Affected Products

• Libarchive versions prior to 3.7.4
• Libarchive version 3.7.3 (confirmed vulnerable)
• Applications and systems utilizing vulnerable Libarchive library for archive processing

Discovery Timeline

• 2024-06-08 - CVE-2024-37407 published to NVD
• 2025-04-29 - Last updated in NVD database

Technical Details for CVE-2024-37407

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory corruption issue that occurs when software reads data past the end or before the beginning of an intended buffer. In the context of CVE-2024-37407, the vulnerable code path is triggered during ZIP archive parsing when the library encounters a file entry with an empty name string while mac-ext processing is active.

The slurp_central_directory function in archive_read_support_format_zip.c fails to properly validate filename lengths before accessing memory, allowing an attacker to craft a malicious ZIP archive that causes the library to read beyond buffer boundaries. This can lead to exposure of sensitive memory contents or application crashes.

Root Cause

The root cause stems from insufficient input validation in the ZIP archive central directory parsing logic. When processing file entries, the code assumes filenames are non-empty and does not adequately check for zero-length name fields before performing memory operations. The mac-ext feature, which handles Mac-specific extended attributes, exacerbates this issue by attempting to process the invalid filename, leading to the out-of-bounds access condition.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious ZIP archive with specially constructed entries containing empty filename fields. When a vulnerable application using Libarchive processes such an archive—particularly with mac-ext enabled—the out-of-bounds read is triggered. Since this vulnerability is exploitable over the network without requiring authentication or user interaction, it poses a significant risk to web services, file processing systems, and any application that handles untrusted ZIP archives.

The vulnerability manifests in the boundary checking logic during central directory parsing. When the archive reader encounters an entry with a zero-length filename and mac-ext processing is enabled, the code attempts to access memory beyond the allocated buffer boundaries. Technical details are available in the GitHub Pull Request Discussion and the associated commit reference.

Detection Methods for CVE-2024-37407

Indicators of Compromise

• Unexpected application crashes or segmentation faults when processing ZIP archives
• Memory access violations in processes utilizing Libarchive for archive extraction
• Core dumps or error logs indicating issues in archive_read_support_format_zip.c or slurp_central_directory functions
• Anomalous ZIP files with zero-length filename entries in central directory records

Detection Strategies

• Implement file integrity monitoring for Libarchive library files to detect unauthorized modifications
• Monitor application logs for crashes or exceptions related to archive processing functions
• Deploy network intrusion detection rules to identify malformed ZIP archives with empty filename entries
• Utilize memory debugging tools (AddressSanitizer, Valgrind) in development environments to detect out-of-bounds access attempts

Monitoring Recommendations

• Enable verbose logging for applications processing untrusted archives to capture processing errors
• Configure crash reporting and monitoring for services utilizing Libarchive
• Implement rate limiting and input validation for file upload endpoints handling ZIP archives
• Monitor system memory usage patterns for anomalies during archive processing operations

How to Mitigate CVE-2024-37407

Immediate Actions Required

• Upgrade Libarchive to version 3.7.4 or later immediately on all affected systems
• Identify all applications and services in your environment that depend on Libarchive for archive processing
• If immediate patching is not possible, consider temporarily disabling mac-ext functionality where feasible
• Implement input validation to reject ZIP archives with empty filename entries before processing

Patch Information

The vulnerability has been addressed in Libarchive version 3.7.4. The fix adds proper boundary checking in the slurp_central_directory function to handle edge cases involving empty filenames. Organizations should update to the patched version as soon as possible.

The security fix is available through the official Libarchive v3.7.4 release. The specific commit addressing this vulnerability can be reviewed at commit hash b6a979481b7d77c12fa17bbed94576b63bbcb0c0.

Workarounds

• Implement pre-processing validation to inspect ZIP archives for entries with empty filenames before passing to Libarchive
• Configure web application firewalls to block uploads of potentially malicious ZIP archives
• Isolate archive processing in sandboxed environments with limited memory access and restricted privileges
• Disable mac-ext functionality if not required for your use case until patching can be completed

# Verify installed Libarchive version
bsdtar --version

# Check for vulnerable library version on Linux systems
ldconfig -p | grep libarchive

# Update Libarchive on Debian/Ubuntu systems
sudo apt-get update && sudo apt-get install libarchive13

# Update Libarchive on RHEL/CentOS systems
sudo yum update libarchive