Executive Summary

This vulnerability exists in The Sleuth Kit through version 4.14.0 within its ISO9660 filesystem parser. Specifically, the parse_susp() function improperly trusts certain length fields (len_id, len_des, and len_src) from a disk image and uses memcpy to copy data into a stack buffer without verifying that the source data is actually within the bounds of the parsed SUSP block.

An attacker can exploit this by crafting a malicious ISO image that causes the program to read beyond the end of the SUSP data buffer. Additionally, a zero-length SUSP entry can cause the parser to enter an infinite loop.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to out-of-bounds reads, which may cause the application to crash or behave unpredictably, resulting in a denial of service (DoS). The infinite parsing loop triggered by a zero-length SUSP entry can also cause the application to hang, further contributing to DoS conditions.

The CVSS scores indicate a low to medium severity impact, with limited confidentiality impact, no integrity impact, and some availability impact.

Useful 0 Not Useful 0