Use-after-free in libarchive - CVE-2019-18408

Vulnerability identifier: #VU22332

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-18408

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the archive_read_format_rar_read_data() function in archive_read_support_format_rar.c in libarchive when handling certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol. A remote attacker can create a specially crafted archive, pass it to the affected application trigger a use-after-free error and crash the application or execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

libarchive
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
libarchive (Alpine package)
libarchive (Ubuntu package)
libarchive (Debian package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
libarchive
Data Computing Appliance (DCA)

Install updates from vendor's website.

libarchive - update to 3.4.0
libarchive (Alpine package) - addressed in versions 3.3.3-r1, 3.4.2-r0
libarchive (Ubuntu package) - addressed in versions 3.1.2-11ubuntu0.16.04.7, 3.2.2-3.1ubuntu0.5, 3.3.3-4ubuntu0.1
libarchive (Debian package) - addressed in versions 3.2.2-2+deb9u2, 3.3.3-4+deb10u1
libarchive - addressed in versions 3.3.3-7.fc29, 3.3.3-7.fc30
Data Computing Appliance (DCA) - update to 4.3.0.0

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14689
• https://github.com/libarchive/libarchive/commit/b8592ecba2f9e451e1f5cb7ab6dcee8b8e7b3f60
• https://github.com/libarchive/libarchive/compare/v3.3.3...v3.4.0

• Remote code execution in libarchive
• Ubuntu update for libarchive
• Debian update for libarchive
• OpenSUSE Linux update for libarchive
• OpenSUSE Linux update for libarchive
• Red Hat update for libarchive
• Red Hat update for libarchive
• Red Hat update for libarchive
• Amazon Linux AMI update for libarchive
• Gentoo update for libarchive
• Use-after-free in libarchive (Alpine package)
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Fedora 30 update for libarchive
• Fedora 29 update for libarchive