Global Buffer Overflow in GNU gzip LZH Decompression

Executive Summary

This vulnerability exists in GNU gzip's LZH decompression logic due to improper reuse of a shared global buffer between different decompression formats (LZ77, LZW, and LZH) within a single execution. The global array used by these routines is not reinitialized between files processed in the same gzip command.

An attacker can exploit this by decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command. This sequence poisons the shared global state, causing the LZH decoder to perform out-of-bounds reads past the end of the allocated buffer, leading to a global buffer overflow.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to out-of-bounds memory reads during decompression, which may cause crashes or potentially allow an attacker to execute arbitrary code or cause denial of service by exploiting the buffer overflow.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update GNU gzip to a version that includes the fix from commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681.

Avoid decompressing specially crafted LZW and LZH files in a single gzip -d command until the update is applied.

Useful 0 Not Useful 0