CVE-2025-31115: 
Rocky Linux vulnerability analysis and mitigation

XZ Utils, a general-purpose data-compression library with command-line tools, was found to contain a significant vulnerability (CVE-2025-31115) affecting versions 5.3.3alpha through 5.8.0. The vulnerability exists in the multithreaded .xz decoder within liblzma, where invalid input can trigger a crash and potentially lead to more severe security implications (GitHub Advisory, NVD).

The vulnerability specifically affects the lzma_stream_decoder_mt function in liblzma. The bug occurs when the decoder frees memory too early, resulting in heap use-after-free conditions and potential null pointer dereference issues. The technical impact includes writing to an address based on the null pointer plus an offset. The vulnerability has been assigned multiple CWE classifications including CWE-416 (Use After Free), CWE-826 (Premature Release of Resource), CWE-366 (Race Condition within a Thread), and CWE-476 (NULL Pointer Dereference). The severity is rated as High with a CVSSv4 score of 8.7 (GitHub Advisory).

The vulnerability primarily affects applications and libraries that utilize the lzma_stream_decoder_mt function. When exploited, it can cause system crashes leading to denial of service. While the crash exploitation is straightforward, achieving full process takeover is considered more challenging, particularly on 64-bit systems with PIE (Position Independent Executable) enabled. However, exploitation potential is higher on 32-bit systems, especially those without PIE (OSS Security, Security Online).

The vulnerability's exploitability varies depending on the system architecture and security features. According to security researchers, while triggering a crash is relatively easy, achieving full process takeover is considered highly impractical on 64-bit systems with PIE/ASLR enabled. However, exploitation is more feasible on 32-bit systems, particularly those without PIE protection ([OSS Security](http://www.openwall.com/lists/oss-security/2025/04/03/2, http://www.openwall.com/lists/oss-security/2025/04/03/3)).

The vulnerability has been fixed in XZ Utils version 5.8.1. For users unable to upgrade immediately, a workaround exists by using the single-threaded decoder, which is not affected by this vulnerability. This can be achieved by using the commands 'xz --decompress --threads=1' or 'xzdec'. Additionally, standalone patches are available for all affected releases, and fixes have been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository (GitHub Advisory).