Thread by @taviso

The libarchive e8 vulnerability is actually really cool, but the ZDI advisory doesn't explain why it's so wild lol. For some reason, I know about RAR filters, so let me provide the background. 🧵 1/n

E8 preprocessing is an old trick to improve compression of executables. All relative calls to the same function will be encoded differently, but... if you temporarily replace them with absolute calls, they'll be identical. More duplication = better compression! 2/n

I promise you will never guess how RAR implemented their e8 filter.... They added a bytecode interpreting VM called RarVM, and let you embed little programs for it into archives that the decompressor would automatically execute (!!!). 3/n

I know about this because I wrote an assembler and linker for this format for fun once 😂 4/n

github.com/taviso/rarvmto…

RarVM was never widely adopted, and eventually it was deprecated. There were a few filters that were actually used, and archives that used them wont decompress correctly without them. Naturally, a solution is needed... 😬 5/n

The solution libarchive implemented was to emulate some of the most popular filters natively. They checksum any embedded bytecode to see if it's one of the filters it recognizes. If it is, it will emulate it for you and your archive will work...🤷‍♂️6/n

The vulnerability is in one of these native filter emulations. The preconditions here are very weird... you can only reach the buggy code if you embed a bytecode program in a RAR archive for a dead VM architecture, and it must have a CRC32 of 0x35AD576887...😂 7/n

It doesn't stop there, RarVM programs could accept parameters that were embedded in the archive headers! Naturally libarchive has to emulate that too, or the filters won't work properly.... 8/n

These parameters are called "Initial Registers", because originally they were literally the values placed in registers when the VM started (a bit like regparm in gcc). The vulnerability here is that a parameter was not validated, could underflow and become very large. 9/n

The result is that the filter would start patching anything that looked like a call instruction all over the heap! This is just a standard memory corruption, but what a wild backstory lol 😂 10/n

Here is the original ZDI advisory! zerodayinitiative.com/blog/2024/4/17…