Heap Out-of-Bounds Read in libregf

Executive Summary

This is a heap out-of-bounds read vulnerability in libregf, a library for parsing Windows registry files. It occurs in the function libregf_value_item_read_value_data() when processing version 1.0 or 1.1 registry hive files. The function incorrectly bounds value data size without accounting for a 4-byte cell offset, causing it to read 4 bytes past the end of a cell if the value size equals the cell size. This can leak adjacent heap memory or crash tools like regfexport and plaso.

The attack requires a crafted REGF hive file with specific conditions: format version 0 or 1, non-string value type, and the value data cell must be the last in its bin. Only a valid XOR-32 checksum in the header is needed; cell contents can be freely crafted since bins lack checksums.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems using libregf-based tools like regfexport, regfinfo, regfmount, or plaso/log2timeline. Check for crashes or memory corruption when processing registry hive files. Use tools like AddressSanitizer (ASan) or Valgrind to detect heap out-of-bounds reads during hive parsing.

Useful 0 Not Useful 0

Impact Analysis

The impact is limited to a 4-byte heap out-of-bounds read, which may cause information disclosure if raw binary value data is exposed by the consumer tool. It could also crash parsers like regfexport or plaso when processing malicious registry hive files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by potentially exposing sensitive registry data through heap memory leaks. If attackers exploit the out-of-bounds read, they could access adjacent memory containing registry values, which might include personal or health-related data. Tools like plaso and regfexport, commonly used in forensic analysis, could inadvertently process malformed hive files, leading to unauthorized data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Update libregf to the latest patched version where the bounds check in libregf_value_item_read_value_data is corrected. Avoid processing untrusted registry hive files until patched. Monitor tools using libregf for crashes or memory corruption during hive file processing.

Useful 0 Not Useful 0