CVE-2025-1632: Libarchive NULL Pointer Dereference DoS

CVE-2025-1632 Overview

A null pointer dereference vulnerability has been identified in libarchive versions up to 3.7.7. This memory corruption flaw affects the list function within the bsdunzip.c file, where improper handling of input can lead to a null pointer being dereferenced. The vulnerability requires local access to exploit and can result in denial of service conditions affecting application availability.

Critical Impact

Local attackers can cause application crashes through null pointer dereference in the bsdunzip utility, potentially disrupting archive extraction operations and system stability.

Affected Products

• libarchive versions up to 3.7.7
• Systems using bsdunzip utility from libarchive
• Applications linking against vulnerable libarchive library

Discovery Timeline

• 2025-02-24 - CVE-2025-1632 published to NVD
• 2025-03-25 - Last updated in NVD database

Technical Details for CVE-2025-1632

Vulnerability Analysis

This vulnerability is classified as a null pointer dereference (CWE-476) with an associated improper resource shutdown or release issue (CWE-404). The flaw resides in the list function within bsdunzip.c, a core component of the libarchive library's bsdunzip utility. When processing specially crafted archive files, the function fails to properly validate pointer states before dereferencing, resulting in an application crash.

The vulnerability requires local access to exploit, meaning an attacker must have the ability to provide malicious archive files to be processed by the bsdunzip utility. While the impact is limited to availability (denial of service) rather than confidentiality or integrity compromise, the public disclosure of a proof-of-concept increases the risk of exploitation in environments where libarchive is used for automated archive processing.

Root Cause

The root cause stems from insufficient null pointer validation in the list function of bsdunzip.c. When the function encounters certain edge cases during archive processing, it attempts to dereference a pointer that may be null, leading to undefined behavior and application termination. This represents a failure to implement defensive programming practices that check pointer validity before use.

Attack Vector

The attack vector is local, requiring an attacker to craft a malicious archive file and have it processed by a vulnerable instance of the bsdunzip utility. Exploitation does not require elevated privileges—low-privileged users with the ability to invoke bsdunzip on arbitrary files can trigger the vulnerability.

The vulnerability mechanism involves the following sequence:

1. An attacker crafts a specially malformed archive file designed to trigger the null pointer condition
2. The malicious file is provided to the bsdunzip utility for processing (list operation)
3. During archive parsing, the list function in bsdunzip.c encounters the malformed data
4. The function attempts to dereference a null pointer due to inadequate validation
5. The application crashes, resulting in denial of service

A proof-of-concept demonstrating this vulnerability has been publicly disclosed. Technical details are available in the GitHub PoC Repository.

Detection Methods for CVE-2025-1632

Indicators of Compromise

• Unexpected crashes or segmentation faults in bsdunzip or applications using libarchive
• Core dumps generated during archive extraction or listing operations
• Increased frequency of application restarts for services utilizing libarchive
• Log entries indicating null pointer access violations in archive processing workflows

Detection Strategies

• Monitor system logs for SIGSEGV or similar signals originating from bsdunzip processes
• Implement application crash monitoring for services dependent on libarchive
• Deploy file integrity monitoring to detect potentially malicious archive files
• Utilize SentinelOne's behavioral AI to detect anomalous application termination patterns

Monitoring Recommendations

• Enable core dump collection and analysis for libarchive-dependent applications
• Configure alerting for repeated process crashes in archive processing services
• Implement rate limiting and sandboxing for archive extraction operations
• Review access logs for unusual archive file submissions to processing systems

How to Mitigate CVE-2025-1632

Immediate Actions Required

• Identify all systems running libarchive versions up to 3.7.7
• Restrict access to bsdunzip utility to trusted users where possible
• Implement input validation for archive files before processing
• Consider isolating archive processing operations in sandboxed environments

Patch Information

At the time of publication, the vendor (libarchive) was contacted regarding this vulnerability but did not respond. Organizations should monitor the VulDB entry and the official libarchive project for security updates. When a patch becomes available, prioritize updating to the patched version across all affected systems.

Workarounds

• Limit execution of bsdunzip to trusted administrative users only
• Validate and scan archive files with security tools before processing with libarchive
• Run archive processing operations in isolated containers or sandboxed environments
• Consider using alternative archive utilities until a patch is available
• Implement process monitoring to automatically restart crashed services

# Configuration example - Restrict bsdunzip access
# Limit bsdunzip execution to specific group
sudo chown root:archive-operators /usr/bin/bsdunzip
sudo chmod 750 /usr/bin/bsdunzip

# Run archive operations in restricted environment
firejail --quiet --private-tmp bsdunzip -l archive.zip