Heap Out-of-Bounds Read in EarthScope libmseed

Executive Summary

This vulnerability is a heap out-of-bounds read in EarthScope libmseed v3.5.4. It occurs in the ms3_detect() function when processing miniSEED 2 record buffers. The function checks if the buffer is at least 40 bytes but fails to ensure it meets the required 48 bytes for a valid miniSEED 2 header. Attackers can provide a 40-47 byte buffer that passes initial checks, causing the function to read up to 8 extra bytes past the buffer's end, potentially crashing the process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses libmseed version 3.5.4 or earlier. Run 'ldconfig -p | grep libmseed' or 'find / -name libmseed.so*' to locate the library. If the version is vulnerable, test parsing miniSEED records with buffers of 40-47 bytes to observe crashes or memory errors using tools like AddressSanitizer.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial-of-service conditions by crashing the application processing miniSEED data. It may lead to instability in software relying on libmseed for seismological data parsing. However, it does not allow arbitrary code execution or information disclosure since the read value is internally validated and not used for further malicious purposes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a heap out-of-bounds read in a seismological data parsing library. However, if exploited, it could lead to denial-of-service conditions in systems processing miniSEED data, potentially disrupting services handling sensitive data. No evidence suggests it enables data breaches or unauthorized access.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update libmseed to a patched version (post-commit c93a36a). If updating is not possible, implement input validation to ensure miniSEED buffers are at least 48 bytes before processing. Disable or restrict applications using libmseed from processing untrusted miniSEED data until patched.

Useful 0 Not Useful 0