How to prevent exploitation of libarchive CVE-2023-30571

Solution In Progress - Updated -

Issue

The CVE-2023-30571 race condition vulnerability in the libarchive library can cause a multi-threaded application using the library to unexpectedly change its umask to 0. This can cause files or directories subsequently created by the application to be world readable and writable, which may allow other system users to obtain sensitive information, modify or remove data from the affected files or directory, or potentially escalate their privileges. This problem can happen when the archive_write_disk_header() libarchive function is called concurrently from multiple threads of a multi-threaded application.

Environment

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content