Full Report
On November 20th, 2024, Zero Day Initiative (ZDI) researchers disclosed a critical flaw in 7-Zip.
Analysis Summary
# Vulnerability: 7-Zip Integer Underflow Leading to Remote Code Execution
## CVE Details
- CVE ID: CVE-2024-11477
- CVSS Score: 7.8 (High)
- CWE: Not specified in detail, likely related to CWE-190 (Integer Overflow or Wraparound) or CWE-121 (Stack-based Buffer Overflow) due to underflow context.
## Affected Systems
- Products: 7-Zip (Specific versions not explicitly listed, but versions prior to the patch release)
- Versions: Versions prior to 24.07
- Configurations: Any configuration utilizing the vulnerable version of 7-Zip software.
## Vulnerability Description
The vulnerability resides within the decompression process of 7-Zip. It involves processing user-supplied data which leads to an **integer underflow**. Successful exploitation allows a threat actor to execute arbitrary code within the context of the affected process. Exploitation requires user interaction (i.e., the user must open a specially crafted archive file).
## Exploitation
- Status: PoC available (Fake PoC uploaded to GitHub leading to phishing, no active exploitation in the wild reported as of writing)
- Complexity: Medium (Requires specific crafted data/archive)
- Attack Vector: Network (via receiving/opening the archive file)
## Impact
- Confidentiality: Potential impact due to arbitrary code execution.
- Integrity: Potential impact due to arbitrary code execution.
- Availability: Potential impact due to arbitrary code execution.
## Remediation
### Patches
- Update immediately to **7-Zip version 24.07 or later**.
### Workarounds
- Remain vigilant when opening archive files, particularly those received from untrusted sources.
## Detection
- Suspicious activity related to 7-Zip processes attempting to execute unauthorized code paths after decompression of untrusted archives.
- Monitoring activity around potentially weaponized archive files being opened. (Note: Specific IoCs for the exploit payload are not provided in this summary.)
## References
- [Vendor advisories/Download link for 7-Zip](https://7-zip.org/download.html)
- [Malformed PoC link on VirusTotal (for analysis context only)](https://www.virustotal.com/gui/url/0e31d5d77f8d60f2083cc7e535d477fc4404a8f9bdc38712100052615ae1d46b/details)