Heap Corruption in LASzip via Truncated VLR Data

Executive Summary

This vulnerability is an invalid free issue in LASzip through version 3.5.0. It occurs in the laszip_read_header() function when processing a crafted LAS or LAZ file with a truncated variable length record (VLR) header. The problem involves freeing uninitialized heap pointers during cleanup, leading to crashes and heap corruption.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor applications using LASzip for crashes when processing LAS/LAZ files. Use tools like AddressSanitizer to identify invalid free operations during file parsing. Check for segmentation faults in logs when handling malformed files with truncated VLR headers.

Useful 0 Not Useful 0

Impact Analysis

If you process untrusted LAS or LAZ files using LASzip 3.5.0 or earlier, an attacker could craft a small file (as small as 227 bytes) to crash your application. This causes a denial of service by triggering a segmentation fault during cleanup when uninitialized pointers are freed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by crashing applications processing untrusted LAS/LAZ files. It does not directly expose or leak sensitive data, but could indirectly impact compliance by disrupting systems handling regulated data like medical imaging (HIPAA) or geospatial data (potential GDPR implications if personal data is involved). The crash could lead to service unavailability, which may violate availability requirements in some compliance frameworks.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade LASzip to a patched version that includes fixes for memory management and VLR handling.
• Implement input validation for LAS/LAZ files to reject malformed or truncated headers before processing.
• Disable or restrict applications that rely on LASzip to process untrusted files until patched.

Useful 0 Not Useful 0