Heap Out-of-Bounds Read in The Sleuth Kit

Executive Summary

This vulnerability is a heap out-of-bounds read in The Sleuth Kit through version 4.15.0. It occurs in the hfs_load_extended_attrs() function when processing HFS+ disk images. The function reads the decmpfs header without checking the attribute length, allowing attackers to supply a crafted image with a com.apple.decmpfs attribute size of 1 to 15 bytes. This causes the function to read past allocated memory, potentially crashing analysis tools like istat or icat.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect HFS+ disk images for malformed com.apple.decmpfs attributes. Use Sleuth Kit tools like istat or icat on suspicious images. Check for crashes or memory corruption during analysis. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause analysis tools like istat or icat to crash when processing a malicious HFS+ disk image. It may also lead to denial of service or potentially arbitrary code execution in the context of the user running the tools. The impact is limited to systems using The Sleuth Kit versions 4.15.0 or earlier.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes crashes in forensic analysis tools like istat or icat when processing crafted HFS+ disk images. It does not directly disclose sensitive data or violate access controls, so its impact on GDPR or HIPAA compliance is likely minimal unless analysis tools fail during forensic investigations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade The Sleuth Kit to a version beyond 4.15.0. Avoid processing untrusted HFS+ disk images until patched. Monitor for crashes in istat or icat tools when handling HFS+ files.

Useful 0 Not Useful 0