Integer Underflow in libfsapfs via KEK Attribute Handling

Executive Summary

libfsapfs through 20260921 has an integer underflow in libfsapfs_key_encrypted_key_read_data() that causes heap out-of-bounds reads. Attackers can exploit this by providing a crafted encrypted APFS image with malformed KEK attributes, such as incorrect HMAC or wrapped KEK attribute lengths. This triggers a cursor to move past the object end, leading to a bounds check failure and memory copy of up to 32 or 40 bytes beyond the allocated heap memory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of libfsapfs installed on your system. If you are using version 20260921 or earlier, your system is vulnerable. Run 'fsapfsinfo --version' or 'pyfsapfs --version' to check the installed version. If the version is vulnerable, update to the latest patched version immediately.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can crash applications like fsapfsinfo, pyfsapfs, dfVFS, or plaso when processing a malicious APFS image. It may also allow reading adjacent heap memory before password verification, potentially exposing sensitive data. The attack requires user interaction to access the crafted image.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive data through heap memory reads. If exploited, it may allow unauthorized access to adjacent memory before password verification, risking data confidentiality. This could violate GDPR's data protection principles and HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update libfsapfs to the latest version beyond 20260921. Avoid mounting or accessing untrusted APFS images until the update is applied. Disable or restrict access to tools like fsapfsinfo, pyfsapfs, dfVFS, or plaso that interact with APFS volumes until patched.

Useful 0 Not Useful 0