libarchive up to 3.6.2 archive_write_disk_posix.c umask race condition

Summaryinfo

A vulnerability marked as problematic has been reported in libarchive up to 3.6.2. The impacted element is the function umask of the file archive_write_disk_posix.c. The manipulation leads to race condition. This vulnerability is documented as CVE-2023-30571. The attack needs to be performed locally. There is not any exploit available.

Detailsinfo

A vulnerability was found in libarchive up to 3.6.2 (File Compression Software) and classified as problematic. This issue affects the function umask of the file archive_write_disk_posix.c. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.

The weakness was released 05/30/2023 as 1876. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2023-30571 since 04/12/2023. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 242814 (NewStart CGSL MAIN 7.02 : libarchive Multiple Vulnerabilities (NS-SA-2025-0118)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (242814) and EUVD (EUVD-2023-34952). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• File Compression Software

Name

• libarchive

Version

• 3.6.0
• 3.6.1
• 3.6.2

License

• open-source

Website

• Product: https://github.com/libarchive/libarchive/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion