Executive Summary

This vulnerability is a heap-based buffer overflow found in the GNU libredwg library, specifically in the bit_read_RC function of the Dwgbmp Utility component. It occurs when processing malformed DWG files, causing an out-of-bounds heap read or write during the decompression of R2004 compressed sections. This flaw can be exploited remotely and has an available public exploit.

The root cause is related to insufficient boundary checks during decompression, which allows the program to read or write beyond allocated memory buffers, potentially leading to crashes or arbitrary code execution.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to a heap-based buffer overflow, which may cause the affected application to crash or allow an attacker to execute arbitrary code remotely without any user interaction or privileges.

This can result in unauthorized access, data corruption, or denial of service, impacting the confidentiality, integrity, and availability of systems using the vulnerable GNU libredwg library.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the affected GNU libredwg component with specially crafted malformed DWG files that trigger the heap-based buffer overflow in the bit_read_RC function. Fuzzing tools and AddressSanitizer were used to identify the issue by processing malformed input files such as a proof-of-concept DWG file.

A practical detection approach involves running the dwgbmp utility from libredwg with a known malicious or malformed DWG file (like the provided proof-of-concept file) and monitoring for crashes or abnormal behavior indicating a heap overflow.

Example command to test the vulnerability (assuming you have a malicious DWG file named poc.dwg):

• LD_PRELOAD=libasan.so ./dwgbmp poc.dwg

This command runs dwgbmp with AddressSanitizer enabled (libasan.so) to detect heap buffer overflows during decompression.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended immediate mitigation step is to apply the official patch provided by the LibreDWG project, identified by commit 8f03865f37f5d4ffd616fef802acc980be54d300.

This patch fixes the decompression overflow by adding boundary checks to prevent integer overflow and buffer overflows during DWG file decompression.

If patching is not immediately possible, avoid processing untrusted or malformed DWG files with the vulnerable versions of libredwg to reduce the risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0