Skip to content

Commit 06ff574

Browse files
azurelinux-securityazurelinux-security
authored
[AutoPR- Security] Patch libarchive for CVE-2026-4111 [HIGH] (#16203)
1 parent ed5acdc commit 06ff574

6 files changed

Lines changed: 350 additions & 11 deletions

File tree

‎SPECS/libarchive/CVE-2026-4111.patch‎

Lines changed: 335 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,335 @@
1+
From dcfbeadacc4f4622aa654dcf4f9de303af7b9904 Mon Sep 17 00:00:00 2001
2+
From: Tim Kientzle <kientzle@acm.org>
3+
Date: Sun, 1 Mar 2026 10:04:01 -0800
4+
Subject: [PATCH 1/2] Infinite loop in Rar5 decompression
5+
6+
Found by: Elhanan Haenel
7+
---
8+
Makefile.am | 2 +
9+
libarchive/test/CMakeLists.txt | 1 +
10+
.../test/test_read_format_rar5_loop_bug.c | 53 +++++
11+
.../test_read_format_rar5_loop_bug.rar.uu | 189 ++++++++++++++++++
12+
4 files changed, 245 insertions(+)
13+
create mode 100644 libarchive/test/test_read_format_rar5_loop_bug.c
14+
create mode 100644 libarchive/test/test_read_format_rar5_loop_bug.rar.uu
15+
16+
diff --git a/Makefile.am b/Makefile.am
17+
index 0189f55..2469df5 100644
18+
--- a/Makefile.am
19+
+++ b/Makefile.am
20+
@@ -507,6 +507,7 @@ libarchive_test_SOURCES= \
21+
libarchive/test/test_read_format_rar_invalid1.c \
22+
libarchive/test/test_read_format_rar_overflow.c \
23+
libarchive/test/test_read_format_rar5.c \
24+
+ libarchive/test/test_read_format_rar5_loop_bug.c \
25+
libarchive/test/test_read_format_raw.c \
26+
libarchive/test/test_read_format_tar.c \
27+
libarchive/test/test_read_format_tar_concatenated.c \
28+
@@ -868,6 +869,7 @@ libarchive_test_EXTRA_DIST=\
29+
libarchive/test/test_read_format_rar5_invalid_dict_reference.rar.uu \
30+
libarchive/test/test_read_format_rar5_leftshift1.rar.uu \
31+
libarchive/test/test_read_format_rar5_leftshift2.rar.uu \
32+
+ libarchive/test/test_read_format_rar5_loop_bug.rar.uu \
33+
libarchive/test/test_read_format_rar5_multiarchive.part01.rar.uu \
34+
libarchive/test/test_read_format_rar5_multiarchive.part02.rar.uu \
35+
libarchive/test/test_read_format_rar5_multiarchive.part03.rar.uu \
36+
diff --git a/libarchive/test/CMakeLists.txt b/libarchive/test/CMakeLists.txt
37+
index d1596c3..002afa0 100644
38+
--- a/libarchive/test/CMakeLists.txt
39+
+++ b/libarchive/test/CMakeLists.txt
40+
@@ -156,6 +156,7 @@ IF(ENABLE_TEST)
41+
test_read_format_rar_filter.c
42+
test_read_format_rar_overflow.c
43+
test_read_format_rar5.c
44+
+ test_read_format_rar5_loop_bug.c
45+
test_read_format_raw.c
46+
test_read_format_tar.c
47+
test_read_format_tar_concatenated.c
48+
diff --git a/libarchive/test/test_read_format_rar5_loop_bug.c b/libarchive/test/test_read_format_rar5_loop_bug.c
49+
new file mode 100644
50+
index 0000000..77dd78c
51+
--- /dev/null
52+
+++ b/libarchive/test/test_read_format_rar5_loop_bug.c
53+
@@ -0,0 +1,53 @@
54+
+/*-
55+
+ * Copyright (c) 2026 Tim Kientzle
56+
+ * All rights reserved.
57+
+ *
58+
+ * Redistribution and use in source and binary forms, with or without
59+
+ * modification, are permitted provided that the following conditions
60+
+ * are met:
61+
+ * 1. Redistributions of source code must retain the above copyright
62+
+ * notice, this list of conditions and the following disclaimer.
63+
+ * 2. Redistributions in binary form must reproduce the above copyright
64+
+ * notice, this list of conditions and the following disclaimer in the
65+
+ * documentation and/or other materials provided with the distribution.
66+
+ *
67+
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
68+
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
69+
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
70+
+ * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
71+
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
72+
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
73+
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
74+
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
75+
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
76+
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
77+
+ */
78+
+#include "test.h"
79+
+
80+
+DEFINE_TEST(test_read_format_rar5_loop_bug)
81+
+{
82+
+ const char *reffile = "test_read_format_rar5_loop_bug.rar";
83+
+ struct archive_entry *ae;
84+
+ struct archive *a;
85+
+ const void *buf;
86+
+ size_t size;
87+
+ la_int64_t offset;
88+
+
89+
+ extract_reference_file(reffile);
90+
+ assert((a = archive_read_new()) != NULL);
91+
+ assertEqualIntA(a, ARCHIVE_OK, archive_read_support_filter_all(a));
92+
+ assertEqualIntA(a, ARCHIVE_OK, archive_read_support_format_all(a));
93+
+ assertEqualIntA(a, ARCHIVE_OK, archive_read_open_filename(a, reffile, 10240));
94+
+
95+
+ // This has just one entry
96+
+ assertEqualIntA(a, ARCHIVE_OK, archive_read_next_header(a, &ae));
97+
+
98+
+ // Read blocks until the end of the entry
99+
+ while (ARCHIVE_OK == archive_read_data_block(a, &buf, &size, &offset)) {
100+
+ }
101+
+
102+
+ assertEqualIntA(a, ARCHIVE_EOF, archive_read_next_header(a, &ae));
103+
+
104+
+ assertEqualIntA(a, ARCHIVE_OK, archive_read_close(a));
105+
+ assertEqualInt(ARCHIVE_OK, archive_free(a));
106+
+}
107+
diff --git a/libarchive/test/test_read_format_rar5_loop_bug.rar.uu b/libarchive/test/test_read_format_rar5_loop_bug.rar.uu
108+
new file mode 100644
109+
index 0000000..3e47004
110+
--- /dev/null
111+
+++ b/libarchive/test/test_read_format_rar5_loop_bug.rar.uu
112+
@@ -0,0 +1,189 @@
113+
+begin 644 test_read_format_rar5_loop_bug.rar
114+
+M4F%R(1H'`0#%&C,R`P$``)T-9%L.`@+P0`"`@`P`@`,``6'(WFP@`?\7_U/^
115+
+M8@!.`B`H````````````````````````````````````````````````````
116+
+M````````````````````````````````````````````````````````````
117+
+M````````````````````````````````````````````````````````````
118+
+M````````````````````````````````````````````````````````````
119+
+M````````````````````````````````````````````````````````````
120+
+M````````````````````````````````````````````````````````````
121+
+M````````````````````````````````````````````````````````````
122+
+M````````````````````````````````````````````````````````````
123+
+M````````````````````````````````````````````````````````````
124+
+M````````````````````````````````````````````````````````````
125+
+M````````````````````````````````````````````````````````````
126+
+M````````````````````````````````````````````````````````````
127+
+M````````````````````````````````````````````````````````````
128+
+M````````````````````````````````````````````````````````````
129+
+M````````````````````````````````````````````````````````````
130+
+M````````````````````````````````````````````````````````````
131+
+M````````````````````````````````````````````````````````````
132+
+M````````````````````````````````````````````````````````````
133+
+M````````````````````````````````````````````````````````````
134+
+M````````````````````````````````````````````````````````````
135+
+M````````````````````````````````````````````````````````````
136+
+M````````````````````````````````````````````````````````````
137+
+M````````````````````````````````````````````````````````````
138+
+M````````````````````````````````````````````````````````````
139+
+M````````````````````````````````````````````````````````````
140+
+M````````````````````````````````````````````````````````````
141+
+M````````````````````````````````````````````````````````````
142+
+M````````````````````````````````````````````````````````````
143+
+M````````````````````````````````````````````````````````````
144+
+M````````````````````````````````````````````````````````````
145+
+M````````````````````````````````````````````````````````````
146+
+M````````````````````````````````````````````````````````````
147+
+M````````````````````````````````````````````````````````````
148+
+M````````````````````````````````````````````````````````````
149+
+M````````````````````````````````````````````````````````````
150+
+M````````````````````````````````````````````````````````````
151+
+M````````````````````````````````````````````````````````````
152+
+M````````````````````````````````````````````````````````````
153+
+M````````````````````````````````````````````````````````````
154+
+M````````````````````````````````````````````````````````````
155+
+M````````````````````````````````````````````````````````````
156+
+M````````````````````````````````````````````````````````````
157+
+M````````````````````````````````````````````````````````````
158+
+M````````````````````````````````````````````````````````````
159+
+M````````````````````````````````````````````````````````````
160+
+M````````````````````````````````````````````````````````````
161+
+M````````````````````````````````````````````````````````````
162+
+M````````````````````````````````````````````````````````````
163+
+M````````````````````````````````````````````````````````````
164+
+M````````````````````````````````````````````````````````````
165+
+M````````````````````````````````````````````````````````````
166+
+M````````````````````````````````````````````````````````````
167+
+M````````````````````````````````````````````````````````````
168+
+M````````````````````````````````````````````````````````````
169+
+M````````````````````````````````````````````````````````````
170+
+M````````````````````````````````````````````````````````````
171+
+M````````````````````````````````````````````````````````````
172+
+M````````````````````````````````````````````````````````````
173+
+M````````````````````````````````````````````````````````````
174+
+M````````````````````````````````````````````````````````````
175+
+M````````````````````````````````````````````````````````````
176+
+M````````````````````````````````````````````````````````````
177+
+M````````````````````````````````````````````````````````````
178+
+M````````````````````````````````````````````````````````````
179+
+M````````````````````````````````````````````````````````````
180+
+M````````````````````````````````````````````````````````````
181+
+M````````````````````````````````````````````````````````````
182+
+M````````````````````````````````````````````````````````````
183+
+M````````````````````````````````````````````````````````````
184+
+M````````````````````````````````````````````````````````````
185+
+M````````````````````````````````````````````````````````````
186+
+M````````````````````````````````````````````````````````````
187+
+M````````````````````````````````````````````````````````````
188+
+M````````````````````````````````````````````````````````````
189+
+M````````````````````````````````````````````````````````````
190+
+M````````````````````````````````````````````````````````````
191+
+M````````````````````````````````````````````````````````````
192+
+M````````````````````````````````````````````````````````````
193+
+M````````````````````````````````````````````````````````````
194+
+M````````````````````````````````````````````````````````````
195+
+M````````````````````````````````````````````````````````````
196+
+M````````````````````````````````````````````````````````````
197+
+M````````````````````````````````````````````````````````````
198+
+M````````````````````````````````````````````````````````````
199+
+M````````````````````````````````````````````````````````````
200+
+M````````````````````````````````````````````````````````````
201+
+M````````````````````````````````````````````````````````````
202+
+M````````````````````````````````````````````````````````````
203+
+M````````````````````````````````````````````````````````````
204+
+M````````````````````````````````````````````````````````````
205+
+M````````````````````````````````````````````````````````````
206+
+M````````````````````````````````````````````````````````````
207+
+M````````````````````````````````````````````````````````````
208+
+M````````````````````````````````````````````````````````````
209+
+M````````````````````````````````````````````````````````````
210+
+M````````````````````````````````````````````````````````````
211+
+M````````````````````````````````````````````````````````````
212+
+M````````````````````````````````````````````````````````````
213+
+M````````````````````````````````````````````````````````````
214+
+M````````````````````````````````````````````````````````````
215+
+M````````````````````````````````````````````````````````````
216+
+M````````````````````````````````````````````````````````````
217+
+M````````````````````````````````````````````````````````````
218+
+M````````````````````````````````````````````````````````````
219+
+M````````````````````````````````````````````````````````````
220+
+M````````````````````````````````````````````````````````````
221+
+M````````````````````````````````````````````````````````````
222+
+M````````````````````````````````````````````````````````````
223+
+M````````````````````````````````````````````````````````````
224+
+M````````````````````````````````````````````````````````````
225+
+M````````````````````````````````````````````````````````````
226+
+M````````````````````````````````````````````````````````````
227+
+M````````````````````````````````````````````````````````````
228+
+M````````````````````````````````````````````````````````````
229+
+M````````````````````````````````````````````````````````````
230+
+M````````````````````````````````````````````````````````````
231+
+M````````````````````````````````````````````````````````````
232+
+M````````````````````````````````````````````````````````````
233+
+M````````````````````````````````````````````````````````````
234+
+M````````````````````````````````````````````````````````````
235+
+M````````````````````````````````````````````````````````````
236+
+M````````````````````````````````````````````````````````````
237+
+M````````````````````````````````````````````````````````````
238+
+M````````````````````````````````````````````````````````````
239+
+M````````````````````````````````````````````````````````````
240+
+M````````````````````````````````````````````````````````````
241+
+M````````````````````````````````````````````````````````````
242+
+M````````````````````````````````````````````````````````````
243+
+M````````````````````````````````````````````````````````````
244+
+M````````````````````````````````````````````````````````````
245+
+M````````````````````````````````````````````````````````````
246+
+M````````````````````````````````````````````````````````````
247+
+M````````````````````````````````````````````````````````````
248+
+M````````````````````````````````````````````````````````````
249+
+M````````````````````````````````````````````````````````````
250+
+M````````````````````````````````````````````````````````````
251+
+M````````````````````````````````````````````````````````````
252+
+M````````````````````````````````````````````````````````````
253+
+M````````````````````````````````````````````````````````````
254+
+M````````````````````````````````````````````````````````````
255+
+M````````````````````````````````````````````````````````````
256+
+M````````````````````````````````````````````````````````````
257+
+M````````````````````````````````````````````````````````````
258+
+M````````````````````````````````````````````````````````````
259+
+M````````````````````````````````````````````````````````````
260+
+M````````````````````````````````````````````````````````````
261+
+M````````````````````````````````````````````````````````````
262+
+M````````````````````````````````````````````````````````````
263+
+M````````````````````````````````````````````````````````````
264+
+M````````````````````````````````````````````````````````````
265+
+M````````````````````````````````````````````````````````````
266+
+M````````````````````````````````````````````````````````````
267+
+M````````````````````````````````````````````````````````````
268+
+M````````````````````````````````````````````````````````````
269+
+M````````````````````````````````````````````````````````````
270+
+M````````````````````````````````````````````````````````````
271+
+M````````````````````````````````````````````````````````````
272+
+M````````````````````````````````````````````````````````````
273+
+M````````````````````````````````````````````````````````````
274+
+M````````````````````````````````````````````````````````````
275+
+M````````````````````````````````````````````````````````````
276+
+M````````````````````````````````````````````````````````````
277+
+M````````````````````````````````````````````````````````````
278+
+M````````````````````````````````````````````````````````````
279+
+M````````````````````````````````````````````````````````````
280+
+M````````````````````````````````````````````````````````````
281+
+M````````````````````````````````````````````````````````````
282+
+M````````````````````````````````````````````````````````````
283+
+M````````````````````````````````````````````````````````````
284+
+M````````````````````````````````````````````````````````````
285+
+M````````````````````````````````````````````````````````````
286+
+M````````````````````````````````````````````````````````````
287+
+M````````````````````````````````````````````````````````````
288+
+M````````````````````````````````````````````````````````````
289+
+M````````````````````````````````````````````````````````````
290+
+M````````````````````````````````````````````````````````````
291+
+M````````````````````````````````````````````````````````````
292+
+M````````````````````````````````````````````````````````````
293+
+M````````````````````````````````````````````````````````````
294+
+M````````````````````````````````````````````````````````````
295+
+M````````````````````````````````````````````````````````````
296+
+M````````````````````````````````````````````````````````````
297+
+M````````````````````````````````````````````````````````````
298+
+M````````````````````````````````````````````````````````````
299+
+5```````````````````Y^;*!`@4`
300+
+`
301+
+end
302+
--
303+
2.45.4
304+
305+
306+
From 1df011cfc1fb74398b264116167929e8b2c19cdb Mon Sep 17 00:00:00 2001
307+
From: Tim Kientzle <kientzle@acm.org>
308+
Date: Sun, 1 Mar 2026 20:24:56 -0800
309+
Subject: [PATCH 2/2] Reject filters when the block length is nonsensical
310+
311+
Credit: Grzegorz Antoniak @antekone
312+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
313+
Upstream-reference: https://github.com/libarchive/libarchive/pull/2877.patch
314+
---
315+
libarchive/archive_read_support_format_rar5.c | 4 +++-
316+
1 file changed, 3 insertions(+), 1 deletion(-)
317+
318+
diff --git a/libarchive/archive_read_support_format_rar5.c b/libarchive/archive_read_support_format_rar5.c
319+
index a3cfa72..87e71ae 100644
320+
--- a/libarchive/archive_read_support_format_rar5.c
321+
+++ b/libarchive/archive_read_support_format_rar5.c
322+
@@ -2912,7 +2912,9 @@ static int parse_filter(struct archive_read* ar, const uint8_t* p) {
323+
if(block_length < 4 ||
324+
block_length > 0x400000 ||
325+
filter_type > FILTER_ARM ||
326+
- !is_valid_filter_block_start(rar, block_start))
327+
+ !is_valid_filter_block_start(rar, block_start) ||
328+
+ (rar->cstate.window_size > 0 &&
329+
+ (ssize_t)block_length > rar->cstate.window_size >> 1))
330+
{
331+
archive_set_error(&ar->archive, ARCHIVE_ERRNO_FILE_FORMAT,
332+
"Invalid filter encountered");
333+
--
334+
2.45.4
335+

‎SPECS/libarchive/libarchive.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Multi-format archive and compression library
22
Name: libarchive
33
Version: 3.6.1
4-
Release: 8%{?dist}
4+
Release: 9%{?dist}
55
# Certain files have individual licenses. For more details see contents of "COPYING".
66
License: BSD AND Public Domain AND (ASL 2.0 OR CC0 1.0 OR OpenSSL)
77
Vendor: Microsoft Corporation
@@ -22,6 +22,7 @@ Patch9: CVE-2025-5916.patch
2222
Patch10: CVE-2025-5917.patch
2323
Patch11: CVE-2025-5918.patch
2424
Patch12: CVE-2025-60753.patch
25+
Patch13: CVE-2026-4111.patch
2526
Provides: bsdtar = %{version}-%{release}
2627

2728
BuildRequires: xz-libs
@@ -75,6 +76,9 @@ make %{?_smp_mflags} check
7576
%{_libdir}/pkgconfig/*.pc
7677

7778
%changelog
79+
* Mon Mar 16 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.6.1-9
80+
- Patch for CVE-2026-4111
81+
7882
* Tue Jan 27 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.6.1-8
7983
- Patch for CVE-2025-60753
8084

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -173,8 +173,8 @@ openssl-static-1.1.1k-39.cm2.aarch64.rpm
173173
libcap-2.60-7.cm2.aarch64.rpm
174174
libcap-devel-2.60-7.cm2.aarch64.rpm
175175
debugedit-5.0-2.cm2.aarch64.rpm
176-
libarchive-3.6.1-8.cm2.aarch64.rpm
177-
libarchive-devel-3.6.1-8.cm2.aarch64.rpm
176+
libarchive-3.6.1-9.cm2.aarch64.rpm
177+
libarchive-devel-3.6.1-9.cm2.aarch64.rpm
178178
rpm-4.18.0-4.cm2.aarch64.rpm
179179
rpm-build-4.18.0-4.cm2.aarch64.rpm
180180
rpm-build-libs-4.18.0-4.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -173,8 +173,8 @@ openssl-static-1.1.1k-39.cm2.x86_64.rpm
173173
libcap-2.60-7.cm2.x86_64.rpm
174174
libcap-devel-2.60-7.cm2.x86_64.rpm
175175
debugedit-5.0-2.cm2.x86_64.rpm
176-
libarchive-3.6.1-8.cm2.x86_64.rpm
177-
libarchive-devel-3.6.1-8.cm2.x86_64.rpm
176+
libarchive-3.6.1-9.cm2.x86_64.rpm
177+
libarchive-devel-3.6.1-9.cm2.x86_64.rpm
178178
rpm-4.18.0-4.cm2.x86_64.rpm
179179
rpm-build-4.18.0-4.cm2.x86_64.rpm
180180
rpm-build-libs-4.18.0-4.cm2.x86_64.rpm

0 commit comments

Comments
 (0)