Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2025/VULN455 _____________________________________________________________________ DATE : 21/07/2025 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running 7-Zip versions prior to 25.00. ===================================================================== https://sourceforge.net/p/sevenzip/discussion/45797/thread/4ed0e379f4/ https://securitylab.github.com/advisories/GHSL-2025-059_7-Zip/ https://securitylab.github.com/advisories/GHSL-2025-058_7-Zip/ _____________________________________________________________________ 7-Zip 25.00 was released. Download 7-Zip for 64-bit Windows x64: https://7-zip.org/a/7z2500-x64.exe 7-Zip for 32-bit Windows x86: https://7-zip.org/a/7z2500.exe 7-Zip for 64-bit Windows ARM64: https://7-zip.org/a/7z2500-arm64.exe 7-Zip Extra: standalone console version, 7z DLL, Plugin for Far Manager: https://7-zip.org/a/7z2500-extra.7z 7-Zip (console version) for 64-bit Linux x86-64 (AMD64): https://7-zip.org/a/7z2500-linux-x64.tar.xz 7-Zip (console version) for 32-bit Linux x86: https://7-zip.org/a/7z2500-linux-x86.tar.xz 7-Zip (console version) for 64-bit Linux ARM64: https://7-zip.org/a/7z2500-linux-arm64.tar.xz 7-Zip (console version) for 32-bit Linux ARM: https://7-zip.org/a/7z2500-linux-arm.tar.xz 7-Zip (console version) for macOS (ARM64 and x86-64): https://7-zip.org/a/7z2500-mac.tar.xz What's new in 7-Zip 25.00: 7-Zip for Windows can now use more than 64 CPU threads for compression to zip/7z/xz archives and for the 7-Zip benchmark. If there are more than one processor group in Windows (on systems with more than 64 cpu threads), 7-Zip distributes running CPU threads across different processor groups. bzip2 compression speed was increased by 15-40%. deflate (zip/gz) compression speed was increased by 1-3%. improved support for zip, cpio and fat archives. fixed some bugs and vulnerabilities. _____________________________________________________________________ GHSL-2025-059: Denial of Service (DoS) because of null pointer dereference in 7-Zip - CVE-2025-53817 Author avatar Jaroslav Lobačevski Coordinated Disclosure Timeline 2025-04-24: Reported as a private issue 2025-04-29: Report acknowledged 2025-07-05: Fixed in v25.00 Summary 7-Zip supports extracting from Compound Documents. Null pointer dereference in the Compound handler may lead to denial of service. Project 7-Zip Tested Version 7-Zip 24.09 Details Null pointer array write attempt in NArchive::NCom::CHandler::GetStream (GHSL-2025-059) When item.Size is a certain large number (item.Size + clusterSize - 1) >> bsLog at [1] may overflow and numClusters64 becomes zero. Note, that if (numClusters64 >= ((UInt32)1 << 31)) check at [2] doesn’t prevent the unsigned integer overflow. Then the vector call ClearAndReserve at [3] doesn’t allocate any memory and the internal vector pointer stays null. This leads to a null pointer write attempt at [4]. Z7_COM7F_IMF(CHandler::GetStream(UInt32 index, ISequentialInStream **stream)) { ... const UInt64 numClusters64 = (item.Size + clusterSize - 1) >> bsLog; // <----- 1 if (numClusters64 >= ((UInt32)1 << 31)) // <----- 2 return E_NOTIMPL; streamSpec->Vector.ClearAndReserve((unsigned)numClusters64); // <----- 3 UInt32 sid = item.Sid; UInt64 size = item.Size; if (size != 0) { for (;; size -= clusterSize) { if (isLargeStream) { if (sid >= _db.FatSize) return S_FALSE; streamSpec->Vector.AddInReserved(sid + 1); // <----- 4 PoC triggers null pointer write dereference when 7zz is compiled with ASAN and extracted, for example as 7zz e -so compound-crash.poc: ==2387581==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5615317c0993 bp 0x7ffcb31a1350 sp 0x7ffcb31a1300 T0) ==2387581==The signal is caused by a WRITE memory access. ==2387581==Hint: address points to the zero page. #0 0x5615317c0993 in CRecordVector::AddInReserved(unsigned int) ../../Archive/../../Common/MyVector.h:249:18 #1 0x5615317bfe66 in NArchive::NCom::CHandler::GetStream(unsigned int, ISequentialInStream**) /src/7-zip/CPP/7zip/Bundles/Alone2/../../Archive/ComHandler.cpp:866:28 #2 0x5615317bea3d in NArchive::NCom::CHandler::Extract(unsigned int const*, unsigned int, int, IArchiveExtractCallback*) /src/7-zip/CPP/7zip/Bundles/Alone2/../../Archive/ComHandler.cpp:806:20 #3 0x561531e94bbb in DecompressArchive(CCodecs*, CArchiveLink const&, unsigned long, NWildcard::CCensorNode const&, CExtractOptions const&, bool, IExtractCallbackUI*, IFolderArchiveExtractCallback*, CArchiveExtractCallback*, UString&, unsigned long&) /src/7-zip/CPP/7zip/Bundles/Alone2/../../UI/Common/Extract.cpp:235:23 #4 0x561531e8fdf1 in Extract(CCodecs*, CObjectVector const&, CRecordVector const&, CObjectVector&, CObjectVector&, NWildcard::CCensorNode const&, CExtractOptions const&, IOpenCallbackUI*, IExtractCallbackUI*, IFolderArchiveExtractCallback*, IHashCalc*, UString&, CDecompressStat&) /src/7-zip/CPP/7zip/Bundles/Alone2/../../UI/Common/Extract.cpp:542:5 #5 0x561531f49d3a in Main2(int, char**) /src/7-zip/CPP/7zip/Bundles/Alone2/../../UI/Console/Main.cpp:1378:21 #6 0x561531f55ae4 in main /src/7-zip/CPP/7zip/Bundles/Alone2/../../UI/Console/MainAr.cpp:162:11 On Windows the same PoC was tested to crash the official 7-Zip build even without ASAN. Impact This issue may lead to denial of service. CWEs CWE-476: NULL Pointer Dereference CVE CVE-2025-53817 - GHSL-2025-059 Credit This issue was discovered and reported by GHSL team member @JarLob (Jaroslav Lobačevski). Contact You can contact the GHSL team at securitylab@github.com, please include a reference to GHSL-2025-059 in any communication regarding this issue. _____________________________________________________________________ GHSL-2025-058: Denial of Service (DoS) because of memory corruption in 7-Zip - CVE-2025-53816 Author avatar Jaroslav Lobačevski Coordinated Disclosure Timeline 2025-04-24: Reported as a private issue 2025-04-29: Report acknowledged 2025-07-05: Fixed in v25.00 Summary Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service. Project 7-Zip Tested Version 7-Zip 24.09 Details Multi byte write heap buffer overflow in NCompress::NRar5::CDecoder (GHSL-2025-058) RAR5 decoder attempts to fix corrupted items by filling them with zeroes. However a miscalculation [2] of the rem value in My_ZeroMemory(_window + _winPos, (size_t)rem); [1] call leads to zeroes written past the allocated buffer. Z7_COM7F_IMF(CDecoder::Code(ISequentialInStream *inStream, ISequentialOutStream *outStream, const UInt64 * /* inSize */, const UInt64 *outSize, ICompressProgressInfo *progress)) { ... #define Z7_RAR_RECOVER_SOLID_LIMIT (1 << 20) ... { const UInt64 lzSize = _lzSize + _winPos; ... #if Z7_RAR_RECOVER_SOLID_LIMIT != 0 else if (lzSize < _lzEnd) { ... // we can report that recovering was made: // _lzError = LZ_ERROR_TYPE_HEADER; // We write zeros to area after corruption: if (_window) { UInt64 rem = _lzEnd - lzSize; // <------- 2 const size_t ws = _winSize; if (rem >= ws) { My_ZeroMemory(_window, ws); _lzSize = ws; _winPos = 0; } else { const size_t cur = ws - _winPos; if (cur <= rem) { rem -= cur; My_ZeroMemory(_window + _winPos, cur); _lzSize += _winPos; _winPos = 0; } My_ZeroMemory(_window + _winPos, (size_t)rem); // <-------- 1 _winPos += (size_t)rem; } } ... } #endif } ... _unpackSize = 0; _unpackSize_Defined = (outSize != NULL); if (_unpackSize_Defined) _unpackSize = *outSize; if ((Int64)_unpackSize >= 0) _lzEnd += _unpackSize; // known end after current file // <------------- 3 else _lzEnd = 0; // unknown end ... } PoC triggers heap buffer write overflow when 7zz is compiled with ASAN and extracted, for example as 7zz e -so rar-crash.rar5: ==2188082==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fc75fbcc844 at pc 0x5567af835070 bp 0x7fff7f71ce30 sp 0x7fff7f71c600 WRITE of size 9469 at 0x7fc75fbcc844 thread T0 #0 0x5567af83506f in __asan_memset /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:67:3 #1 0x5567b0167b0c in My_ZeroMemory(void*, unsigned long) /src/7-zip/CPP/7zip/Bundles/Alone2/../../Compress/Rar5Decoder.cpp:63:5 #2 0x5567b017c257 in NCompress::NRar5::CDecoder::Code(ISequentialInStream*, ISequentialOutStream*, unsigned long const*, unsigned long const*, ICompressProgressInfo*) /src/7-zip/CPP/7zip/Bundles/Alone2/../../Compress/Rar5Decoder.cpp:1905:11 #3 0x5567aff075c0 in NArchive::NRar5::CUnpacker::Code(NArchive::NRar5::CItem const&, NArchive::NRar5::CItem const&, unsigned long, ISequentialInStream*, ISequentialOutStream*, ICompressProgressInfo*, bool&) /src/7-zip/CPP/7zip/Bundles/Alone2/../../Archive/Rar/Rar5Handler.cpp:1165:24 #4 0x5567aff24721 in NArchive::NRar5::CHandler::Extract(unsigned int const*, unsigned int, int, IArchiveExtractCallback*) /src/7-zip/CPP/7zip/Bundles/Alone2/../../Archive/Rar/Rar5Handler.cpp:3293:25 #5 0x5567b0244c0b in DecompressArchive(CCodecs*, CArchiveLink const&, unsigned long, NWildcard::CCensorNode const&, CExtractOptions const&, bool, IExtractCallbackUI*, IFolderArchiveExtractCallback*, CArchiveExtractCallback*, UString&, unsigned long&) /src/7-zip/CPP/7zip/Bundles/Alone2/../../UI/Common/Extract.cpp:235:23 #6 0x5567b023fe41 in Extract(CCodecs*, CObjectVector const&, CRecordVector const&, CObjectVector&, CObjectVector&, NWildcard::CCensorNode const&, CExtractOptions const&, IOpenCallbackUI*, IExtractCallbackUI*, IFolderArchiveExtractCallback*, IHashCalc*, UString&, CDecompressStat&) /src/7-zip/CPP/7zip/Bundles/Alone2/../../UI/Common/Extract.cpp:542:5 #7 0x5567b02f9d8a in Main2(int, char**) /src/7-zip/CPP/7zip/Bundles/Alone2/../../UI/Console/Main.cpp:1378:21 #8 0x5567b0305b34 in main /src/7-zip/CPP/7zip/Bundles/Alone2/../../UI/Console/MainAr.cpp:162:11 On Windows the same PoC was tested to crash the official 7-Zip build even without ASAN. Impact The bytes past the allocated heap buffer are always overwritten with zeroes: My_ZeroMemory(_window + _winPos, (size_t)rem) [1], but rem is calculated as UInt64 rem = _lzEnd - lzSize; [2] where _lzEnd depends on the size of the previous item in archive which is attacker controlled: _lzEnd += _unpackSize [3]. Thus the attacker may control how many bytes to overwrite. It is unlikely it could lead to arbitrary code execution, but it may lead to denial of service because of the memory corruption. CWEs CWE-122: Heap-based Buffer Overflow CVE CVE-2025-53816 - GHSL-2025-058 Credit This issue was discovered and reported by GHSL team member @JarLob (Jaroslav Lobačevski). Contact You can contact the GHSL team at securitylab@github.com, please include a reference to GHSL-2025-058 in any communication regarding this issue. ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================