CVE-2024-57970 Memory corruption in libarchive
A heap-based buffer over-read in libarchive allows attackers to cause denial of service or disclose information via a crafted TAR archive.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-57970?
CVE-2024-57970 is a medium-severity memory corruption vulnerability in libarchive, published on 16 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.
Weakness: CWE-126
Which versions are affected by CVE-2024-57970?
Linux distribution packages (14)
bsdtar AlmaLinux:10 | All versions | 3.7.7-2.el10_0 |
libarchive AlmaLinux:10 | All versions | 3.7.7-2.el10_0 |
libarchive-devel AlmaLinux:10 | All versions | 3.7.7-2.el10_0 |
bsdcat-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:3.7.7-2.el10_0 |
bsdcpio-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:3.7.7-2.el10_0 |
bsdtar Red Hat:enterprise_linux:10.0 | All versions | 0:3.7.7-2.el10_0 |
bsdtar-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:3.7.7-2.el10_0 |
bsdunzip-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:3.7.7-2.el10_0 |
libarchive Red Hat:enterprise_linux:10.0 | All versions | 0:3.7.7-2.el10_0 |
libarchive-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:3.7.7-2.el10_0 |
libarchive-debugsource Red Hat:enterprise_linux:10.0 | All versions | 0:3.7.7-2.el10_0 |
libarchive-devel Red Hat:enterprise_linux:10.0 | All versions | 0:3.7.7-2.el10_0 |
libarchive Rocky Linux:10 | All versions | 0:3.7.7-2.el10_0 |
libarchive openSUSE:Tumbleweed | All versions | 3.7.7-2.1 |
How do I fix CVE-2024-57970?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-57970 being exploited?
There is no known exploitation of CVE-2024-57970 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2024-57970, ALSA-2025:7510, BELL-CVE-2024-57970, GHSA-2q66-6w43-8rm9, JLSEC-2025-250, MINI-5h6q-fffc-fp96 and 3 more.