CVE-2025-25724: Libarchive DOS Vulnerability

CVE-2025-25724 Overview

CVE-2025-25724 is a vulnerability in libarchive through version 3.7.7 where the list_item_verbose function in tar/util.c fails to check the return value of strftime. This unchecked return value can lead to a denial of service or other unspecified impacts when processing a specially crafted TAR archive with verbose output enabled (verbose value of 2). The vulnerability arises because the 100-byte buffer allocated for date/time formatting may be insufficient for certain custom locale configurations.

Critical Impact

Attackers can craft malicious TAR archives that, when processed with verbose output enabled, may cause denial of service conditions or potentially other undefined behavior due to buffer overflow scenarios in locale-specific date formatting.

Affected Products

• libarchive versions through 3.7.7
• Applications and utilities that use libarchive for TAR archive processing with verbose output
• BSD tar implementations using vulnerable libarchive versions

Discovery Timeline

• 2025-03-02 - CVE-2025-25724 published to NVD
• 2025-07-17 - Last updated in NVD database

Technical Details for CVE-2025-25724

Vulnerability Analysis

The vulnerability is classified as CWE-252 (Unchecked Return Value). In the affected code path within list_item_verbose function located in tar/util.c, the application calls strftime to format timestamp information for verbose archive listing. The function uses a fixed 100-byte buffer to store the formatted date/time string. However, the return value of strftime is not validated to confirm successful formatting.

When strftime fails (returns 0), the buffer contents are undefined. More critically, when the formatted string exceeds the 100-byte buffer—which can occur with certain locale configurations that produce longer date/time representations—buffer overflow conditions may occur. This can result in denial of service through application crashes or potentially other unspecified security impacts.

The vulnerability requires local access and can be triggered when a user extracts or lists a maliciously crafted TAR archive using the -v (verbose) flag with a verbosity level of 2.

Root Cause

The root cause is the missing validation of the strftime return value in the list_item_verbose function. The function assumes that the 100-byte buffer will always be sufficient for the formatted date/time string across all locale configurations. This assumption is incorrect because:

1. Different locales can produce significantly longer date/time representations
2. Custom locale configurations may include additional formatting elements
3. The strftime function returns 0 on both error and when the buffer is too small, but this return value is ignored

The vulnerable code path is located at lines 751-752 in tar/util.c.

Attack Vector

The attack requires local access to the system. An attacker must craft a malicious TAR archive containing specially constructed timestamp values or metadata that, when combined with a non-standard locale setting, causes the strftime output to exceed the fixed buffer size. The attack is triggered when a victim extracts or lists the archive contents with verbose output enabled (verbosity level 2).

The exploitation scenario involves:

1. Attacker creates a specially crafted TAR archive with timestamp metadata designed to produce long formatted strings
2. Victim downloads or receives the malicious archive
3. Victim attempts to list or extract the archive using bsdtar -tvv or similar verbose commands
4. The strftime call overflows the 100-byte buffer, causing denial of service or other undefined behavior

For technical details on the vulnerability mechanism, see the GitHub Gist Example Code and the GitHub PoC Repository.

Detection Methods for CVE-2025-25724

Indicators of Compromise

• Unexpected crashes or segmentation faults in bsdtar or applications using libarchive when processing TAR archives
• Abnormal behavior when listing archive contents with verbose output enabled
• Core dumps or crash logs referencing list_item_verbose or strftime functions in libarchive
• Memory corruption errors in applications that process TAR archives

Detection Strategies

• Monitor for application crashes in archive processing utilities with stack traces pointing to tar/util.c
• Implement file integrity monitoring for TAR archives from untrusted sources before processing
• Use memory sanitizers (AddressSanitizer, Valgrind) in development and testing environments to detect buffer overflows
• Deploy endpoint detection solutions to identify abnormal archive processing behavior

Monitoring Recommendations

• Audit usage of verbose flags when extracting untrusted TAR archives
• Log and review all archive extraction operations from external or untrusted sources
• Monitor system locale configurations for non-standard settings that might increase exploitation risk
• Implement alerting for repeated crashes in archive processing utilities

How to Mitigate CVE-2025-25724

Immediate Actions Required

• Upgrade libarchive to a patched version when available from the vendor
• Avoid using verbose output (-vv or verbose level 2) when processing untrusted TAR archives
• Configure systems to use standard locale settings (e.g., en_US.UTF-8) to reduce buffer overflow risk
• Implement input validation and sandboxing for archive processing operations

Patch Information

No official patch information is currently available in the CVE data. Organizations should monitor the official libarchive repository and security advisories for patch releases. The vulnerable code is located in tar/util.c at lines 751-752, where the strftime return value should be checked and handled appropriately.

Review the GitHub Code Reference for details on the affected code location.

Workarounds

• Avoid processing TAR archives from untrusted sources with verbose output enabled
• Set the LC_TIME environment variable to a known safe locale before processing archives: export LC_TIME=C
• Use alternative archive utilities that do not rely on the vulnerable code path for untrusted archives
• Implement sandboxing or containerization for archive extraction operations to limit impact of potential exploitation

# Configuration example - Use safe locale when processing archives
export LC_TIME=C
export LC_ALL=C

# Process archive with minimal verbosity
bsdtar -tf archive.tar

# Or use containerized extraction for untrusted archives
podman run --rm -v /path/to/archives:/archives:ro alpine tar -tf /archives/untrusted.tar