Out-of-Bounds Read in Sleuth Kit APFS Parser Causes Info Disclosure

Executive Summary

This vulnerability exists in The Sleuth Kit up to version 4.14.0, specifically in the APFS filesystem keybag parser. The issue arises because the wrapped_key_parser class processes length fields controlled by an attacker without proper bounds checking. This leads to out-of-bounds heap reads past the allocated buffer.

An attacker can exploit this by crafting a malicious APFS disk image that, when parsed by any Sleuth Kit tool handling APFS volumes, can cause information disclosure or application crashes.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to information disclosure, meaning sensitive data could be exposed unintentionally. Additionally, it can cause the affected tools to crash, potentially disrupting forensic or analysis workflows that rely on The Sleuth Kit for APFS volume parsing.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Sleuth Kit allows an attacker to cause information disclosure by exploiting an out-of-bounds read in the APFS filesystem keybag parser. This could potentially expose sensitive data when processing malicious APFS disk images.

Such information disclosure risks may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access or leaks.

However, the provided information does not explicitly detail the direct effects on compliance or specific regulatory implications.

Useful 0 Not Useful 0