NULL Pointer Dereference in The Sleuth Kit via HFS+ Image Handling

Executive Summary

The Sleuth Kit through version 4.15.0 has a NULL pointer dereference flaw in the decmpfs_decompress_lzvn_attr() function. Attackers exploit this by providing a specially crafted HFS+ disk image with an oversized uncompressed_size value in an LZVN inline com.apple.decmpfs attribute. This causes memory allocation to fail, leading the decoder to write data through a NULL pointer, which crashes the application and results in a denial of service.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to The Sleuth Kit tool and involves crafted HFS+ images. Detection requires analyzing files processed by The Sleuth Kit. Use the tool's debug or verbose modes to check for crashes when processing HFS+ images. Example command: tsk_loaddb -v -i raw -o 0 -f hfs -b image.dd. Monitor for NULL pointer dereference errors in logs.

Useful 0 Not Useful 0

Impact Analysis

If you use The Sleuth Kit to analyze disk images, an attacker could crash the tool by providing a malicious HFS+ image file. This would disrupt your forensic analysis or data recovery operations, potentially causing loss of access to important data or tools during critical investigations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by disrupting forensic investigations or data recovery processes that rely on The Sleuth Kit. If such disruptions lead to delays or failures in data handling, they might violate requirements for timely access, integrity, or availability of sensitive data under regulations like GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade The Sleuth Kit to the latest version beyond 4.15.0. Avoid processing untrusted HFS+ images with vulnerable versions. Implement input validation for files processed by The Sleuth Kit. Disable or restrict access to decmpfs decompression features if not required.

Useful 0 Not Useful 0