Null Pointer Dereference in lrzip ucompthread Function (Local

Executive Summary

CVE-2025-15571 is a concurrency-related null pointer dereference vulnerability found in the lrzip compression tool, specifically in the function ucompthread within the file stream.c. The issue arises because one thread can set a pointer to NULL while another thread is accessing it, leading to a null pointer dereference (NPD). This causes the program to crash or terminate unexpectedly.

The vulnerability occurs due to improper synchronization and premature deallocation of shared thread-related data structures used during decompression. It can be reliably triggered by exploiting race conditions in the code.

The attack requires local access to the system and is considered easy to exploit, with a publicly available proof-of-concept exploit.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability primarily impacts the availability of the lrzip software by causing it to crash or terminate unexpectedly during decompression operations.

An attacker with local access can exploit this flaw to trigger a denial of service (DoS) condition, disrupting normal use of the software.

Since the exploit requires local privileges, remote exploitation is not possible, but it still poses a risk in environments where local access can be obtained.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by reproducing the null pointer dereference condition in the lrzip tool. A proof-of-concept exploit is publicly available and can be used to trigger the crash.

To detect the issue, you can run the lrzip binary with the provided PoC file using the following command:

• ./lrzip -t -p2 ./PoC_NPD

Additionally, compiling lrzip with AddressSanitizer enabled can help detect the null pointer dereference during testing or debugging. Compilation flags include:

• gcc -fsanitize=address -fno-omit-frame-pointer -g -O0
• g++ -fsanitize=address -fno-omit-frame-pointer -g -O0

AddressSanitizer will report segmentation faults caused by the null pointer dereference in the ucompthread function.

Useful 0 Not Useful 0

Mitigation Strategies

Currently, no known countermeasures or patches have been provided by the lrzip project to fix this vulnerability.

Since the exploit requires local access and can cause a denial of service by crashing the application, immediate mitigation steps include:

• Restrict local access to systems running vulnerable versions of lrzip (up to 0.651).
• Avoid running untrusted or malicious lrzip decompression tasks locally.
• Consider using alternative compression tools that do not have this vulnerability.

Monitoring for crashes or abnormal terminations of lrzip processes can help detect exploitation attempts.

Useful 0 Not Useful 0