CVE-2023-30571

Name
CVE-2023-30571
Description
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://groups.google.com/g/libarchive-announce
MISC https://github.com/libarchive/libarchive/issues/1876

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:* libarchive >= None <= 3.6.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
libarchive edge-main 3.6.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libarchive edge-main 3.6.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libarchive edge-main 3.6.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libarchive edge-main 3.5.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libarchive edge-main 3.4.2-r0 None possibly vulnerable
libarchive edge-main 3.4.0-r0 None possibly vulnerable
libarchive edge-main 3.3.2-r1 None possibly vulnerable
libarchive 3.22-main 3.6.1-r2 None possibly vulnerable
libarchive 3.22-main 3.6.1-r0 None possibly vulnerable
libarchive 3.22-main 3.6.0-r0 None possibly vulnerable
libarchive 3.22-main 3.4.2-r0 None possibly vulnerable
libarchive 3.22-main 3.4.0-r0 None possibly vulnerable
libarchive 3.22-main 3.3.2-r1 None possibly vulnerable
libarchive 3.21-main 3.6.1-r2 None possibly vulnerable
libarchive 3.21-main 3.6.1-r0 None possibly vulnerable
libarchive 3.21-main 3.6.0-r0 None possibly vulnerable
libarchive 3.21-main 3.4.2-r0 None possibly vulnerable
libarchive 3.21-main 3.4.0-r0 None possibly vulnerable
libarchive 3.21-main 3.3.2-r1 None possibly vulnerable
libarchive 3.20-main 3.6.1-r2 None possibly vulnerable
libarchive 3.20-main 3.6.1-r0 None possibly vulnerable
libarchive 3.20-main 3.6.0-r0 None possibly vulnerable
libarchive 3.20-main 3.4.2-r0 None possibly vulnerable
libarchive 3.20-main 3.4.0-r0 None possibly vulnerable
libarchive 3.20-main 3.3.2-r1 None possibly vulnerable
libarchive 3.19-main 3.6.1-r2 None possibly vulnerable
libarchive 3.19-main 3.6.1-r0 None possibly vulnerable
libarchive 3.19-main 3.6.0-r0 None possibly vulnerable
libarchive 3.19-main 3.4.2-r0 None possibly vulnerable
libarchive 3.19-main 3.4.0-r0 None possibly vulnerable
libarchive 3.19-main 3.3.2-r1 None possibly vulnerable
libarchive 3.17-main 3.6.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable