CVE-2024-48615: 
NixOS vulnerability analysis and mitigation

A Null Pointer Dereference vulnerability was discovered in libarchive 3.7.6 and earlier versions, specifically affecting the bsdtar program in the header_pax_extension function at rchive_read_support_format_tar.c:1844:8. The vulnerability was disclosed on March 28, 2025 (NVD).

The vulnerability occurs in the header_pax_extension function when processing TAR archives. The issue arises at line 1844 of archive_read_support_format_tar.c where a null pointer dereference can occur. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (SNYK).

The vulnerability can lead to a denial of service condition through application crash when processing specially crafted TAR archives. The impact primarily affects the availability of the system, with no direct impact on confidentiality or integrity (SNYK).

The vulnerability can be triggered by processing a specially crafted TAR archive file. A proof of concept has been published demonstrating the crash condition (GitHub POC).

Several distributions have released fixes for this vulnerability. Debian has marked this as fixed in multiple versions including bullseye (3.4.3-2+deb11u2) and bookworm (3.6.2-1+deb12u2). The vulnerability was introduced in version 3.7.5 and fixed in subsequent releases (Debian Tracker).