CVE-2025-15571: 
NixOS vulnerability analysis and mitigation

CVE-2025-15571 is a null pointer dereference vulnerability in the ucompthread function of stream.c in ckolivas lrzip up to and including version 0.651. The flaw is rooted in improper resource shutdown or release (CWE-404, CWE-476) and is exploitable only from a local environment by a low-privileged user. It was reported via a GitHub issue on August 12, 2025, and publicly disclosed in February 2026; the project maintainer had not responded or released a patch as of the time of disclosure. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, GitHub Issue).

The vulnerability is a concurrency-related null pointer dereference (CWE-476) caused by a race condition between the ucompthread worker thread and the clear_rulist cleanup function in lrzip.c. When decompression fails, clear_rulist deallocates sinfo->ucthreads while a concurrent ucompthread thread may still attempt to dereference &sts->sinfo->ucthreads[i] at stream.c:1551, resulting in a read from a null/zero-page address. Exploitation requires local access, low privileges, and the ability to supply a crafted input file processed with multi-threading enabled (e.g., -p2). A public PoC file and ASAN-confirmed crash report are available in the GitHub issue (GitHub Issue, PoC File).

Successful exploitation causes a denial of service (DoS) by crashing the lrzip process via a segmentation fault triggered by the null pointer dereference. There is no impact on confidentiality or integrity — only availability is affected, limited to the lrzip application itself. The scope is unchanged, meaning the crash does not propagate beyond the affected process or enable lateral movement (Red Hat CVE, GitHub Issue).

A proof-of-concept exploit (crafted PoC file and reproduction instructions) has been publicly disclosed on GitHub. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), reflecting very low probability of exploitation in the near term. The CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT (GitHub Issue, Feedly).

1. Obtain lrzip ≤ 0.651: Confirm the target system is running a vulnerable version of lrzip (latest release is 0.651, dated March 8, 2022).
2. Download the PoC file: Retrieve the crafted PoC archive from the public GitHub issue attachment (PoC_NPD.zip) and extract the PoC_NPD file (PoC File).
3. Trigger multi-threaded decompression: Run lrzip in test/decompression mode with at least two threads to activate the race condition window: ./lrzip -t -p2 ./PoC_NPD.
4. Race condition triggers crash: The crafted file causes decompression to fail, invoking clear_rulist which frees sinfo->ucthreads; a concurrent ucompthread thread then dereferences the now-null pointer at stream.c:1551, producing a SIGSEGV and crashing the process (GitHub Issue).

• Logs: Application crash logs or core dumps referencing ucompthread in stream.c at line 1551; ASAN output showing SEGV on unknown address 0x000000000080.
• Process: Unexpected termination of the lrzip process with a segmentation fault (signal 11/SIGSEGV) during decompression or test operations.
• File System: Presence of the crafted file PoC_NPD or similarly malformed .lrz archives in directories accessible to local users.

No patch has been released by the project maintainer as of the time of disclosure. Recommended mitigations include: (1) restricting local access to systems running lrzip ≤ 0.651 to authorized personnel only; (2) limiting user privileges to the minimum required; (3) avoiding use of lrzip with untrusted input files; (4) considering alternative compression tools if lrzip is not mission-critical; and (5) monitoring the ckolivas/lrzip GitHub repository for future patch releases (Red Hat CVE, GitHub Issue).

Red Hat has acknowledged the vulnerability and published a CVE entry, though no Red Hat products appear to be directly affected. The Tenable Nessus plugin 298650 has been released to detect vulnerable lrzip installations. No significant public commentary from security researchers or broader media coverage has been identified beyond the original GitHub issue report (Red Hat CVE, Tenable).