Null Pointer Dereference in iccDEV ICC Profile Parsing Causes DoS

Executive Summary

This vulnerability is a null pointer dereference in the function CIccProfileXml::ParseBasic() of the iccDEV library. It occurs when the code attempts to access the 'children' member of an XML node without checking if it is null. Specifically, when parsing ICC profile XML data, if certain XML elements like 'ProfileVersion' or 'ProfileSubClassVersion' lack child nodes, the code dereferences a null pointer, causing a crash or denial of service. The issue was fixed by adding checks to ensure the 'children' pointer is not null before accessing its content. [1, 3, 4]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service (DoS) condition by crashing the application that uses the iccDEV library to parse ICC profile XML data. An attacker with local access can exploit this by providing maliciously crafted ICC profiles that trigger the null pointer dereference, leading to application crashes or abnormal termination. The impact affects availability but does not compromise confidentiality or integrity. [2, 4]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the iccDEV tool (specifically iccFromXml) with crafted ICC profile XML files that contain empty or malformed elements such as missing child nodes for "ProfileVersion" or "ProfileSubClassVersion". A crash or segmentation fault (SEGV) during parsing indicates the presence of the vulnerability. Using debugging tools like AddressSanitizer can help detect invalid memory access at the source code location CIccProfileXml::ParseBasic(). There are no specific network detection commands since the attack vector is local and requires user interaction. To test, you can run iccFromXml with a crafted XML file that triggers the null pointer dereference, for example: `iccFromXml malformed_profile.xml` and observe if the application crashes. [4]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade iccDEV to version 2.3.1.2 or later, where the vulnerability has been patched by adding null pointer checks in the CIccProfileXml::ParseBasic() function. Until the upgrade, avoid processing untrusted or malformed ICC profile XML files with vulnerable versions of iccDEV to prevent denial of service. No workarounds are provided. [2, 1]

Useful 0 Not Useful 0