Executive Summary

This vulnerability exists in libgphoto2, a camera access and control library, in versions up to and including 2.5.33. It is an out-of-bounds read issue in the PTP_DPFF_Enumeration case of the function ptp_unpack_Sony_DPD() located in camlibs/ptp2/ptp-pack.c at line 856.

The problem occurs because the function reads a 2-byte enumeration count (N) using dtoh16o(data, *poffset) without first verifying that there are at least 2 bytes remaining in the buffer. This check is present in the standard ptp_unpack_DPD() function but was omitted in this Sony-specific variant by oversight.

This flaw can lead to reading memory outside the intended buffer bounds, which is a classic out-of-bounds read vulnerability.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability has a CVSS v3.1 base score of 5.2, indicating a moderate severity. It requires physical access (AV:P) but has low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N).

The impact includes high confidentiality impact (C:H) and low availability impact (A:L), with no integrity impact (I:N). This means an attacker with physical access could potentially read sensitive memory contents, leading to information disclosure.

Since the vulnerability involves an out-of-bounds read, it could be exploited to leak sensitive data from memory, which might compromise confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update libgphoto2 to a version later than 2.5.33 where the issue has been fixed by commit 3b9f9696be76ae51dca983d9dd8ce586a2561845.

Useful 0 Not Useful 0