CVE-2025-60753 Overview
CVE-2025-60753 affects libarchivebsdtar versions before 3.8.1. The flaw resides in the apply_substitution function in tar/subst.c, which processes -s substitution rules passed on the command line. Crafted substitution patterns trigger unbounded memory allocation, resulting in an Out-of-Memory crash and denial of service. The weakness is classified as uncontrolled resource consumption [CWE-400]. Exploitation requires local access and user interaction, since an operator must invoke bsdtar with the malicious -s rule or process attacker-supplied input. The impact is limited to availability. No code execution or data disclosure is possible through this flaw.
Critical Impact
A crafted -s substitution rule causes bsdtar to allocate memory without bound, crashing the process and interrupting archive operations on the host.
Affected Products
- libarchive bsdtar versions prior to 3.8.1
- Linux and Unix distributions bundling vulnerable libarchive packages
- Build pipelines and backup tools that invoke bsdtar with user-controlled substitution rules
Discovery Timeline
- 2025-11-05 - CVE-2025-60753 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-60753
Vulnerability Analysis
The bsdtar utility supports GNU-style path rewriting through the -s /pattern/replacement/ option. The apply_substitution routine in tar/subst.c expands matched substitutions into an output buffer. When the substitution rule is crafted to produce explosive output growth, the function requests memory without applying an upper bound. The allocator eventually fails or the kernel OOM-killer terminates the process. Any workflow that pipes archive member names through user-influenced -s rules becomes a reliable denial-of-service target. The vulnerability is confined to availability; integrity and confidentiality are not affected.
Root Cause
The root cause is missing validation of expansion size inside apply_substitution. The function does not cap allocation requests or detect pathological pattern expansion. This matches the [CWE-400] uncontrolled resource consumption pattern, where a resource allocation path lacks a quota enforced against adversarial input.
Attack Vector
The attack vector is local and requires user interaction. An attacker supplies a malicious -s substitution rule, a wrapper script, or an archive whose member names trigger the pathological expansion. When an operator or automated job runs bsdtar with that input, the process consumes available memory and terminates. Multi-tenant build systems, CI runners, and shared file servers that accept third-party archives are the most exposed deployments.
No verified proof-of-concept code is published. See the libarchive issue #2725 discussion for upstream analysis.
Detection Methods for CVE-2025-60753
Indicators of Compromise
- Repeated termination of bsdtar processes with SIGKILL or exit status indicating out-of-memory conditions.
- Kernel log entries from oom-killer naming bsdtar or libarchive-linked binaries as the victim process.
- Spikes in resident set size (RSS) for bsdtar immediately before process death during archive extraction or listing.
Detection Strategies
- Inventory installed libarchive packages and flag any build below version 3.8.1 across Linux, macOS, and BSD hosts.
- Audit scripts, Makefiles, and CI pipelines for bsdtar -s usage where the pattern or replacement originates from untrusted input.
- Alert on repeated bsdtar crashes in process telemetry, especially on build servers and backup hosts.
Monitoring Recommendations
- Forward dmesg and journalctl -k output to centralized logging and search for OOM events referencing bsdtar.
- Track per-process memory ceilings for archive utilities and raise alerts when consumption exceeds historical baselines.
- Correlate archive-processing job failures with host memory pressure to identify exploitation attempts versus benign faults.
How to Mitigate CVE-2025-60753
Immediate Actions Required
- Upgrade libarchive and bsdtar to version 3.8.1 or later on all affected systems.
- Restrict who can supply -s substitution rules to bsdtar in shared pipelines and remove the option where it is not required.
- Apply operating system memory limits (ulimit -v, cgroup memory.max) to constrain archive utilities invoked by automation.
Patch Information
The fix ships in libarchive 3.8.1. Track upstream progress and patch notes at the libarchive GitHub issue #2725. Distribution maintainers are backporting the fix to supported branches; apply vendor updates as they publish.
Workarounds
- Avoid passing attacker-controlled strings to the -s option; validate or statically define substitution rules.
- Run bsdtar under a memory-limited cgroup or systemd slice so a crash cannot destabilize the host.
- Replace bsdtar -s with equivalent post-extraction rename logic in a sandboxed script until patches are deployed.
# Configuration example: constrain bsdtar memory via systemd-run
systemd-run --scope -p MemoryMax=512M -p MemorySwapMax=0 \
bsdtar -xf /path/to/archive.tar -C /tmp/extract
# Alternative: shell-level cap before invoking bsdtar
ulimit -v 524288 # 512 MB virtual memory
bsdtar -tf /path/to/archive.tar
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
