Heap-based Buffer Overflow in GNU LibreDWG

Executive Summary

This vulnerability is a heap-based buffer overflow found in the decompress_R2004_section function of the LibreDWG library. It occurs when parsing specially crafted DWG R2004 input files, causing an out-of-bounds write in heap memory during the decompression process. The root cause is related to incorrect buffer size management during decompression, where the buffer is reallocated to a smaller size but the code continues to write beyond this smaller buffer, leading to memory corruption.

The vulnerability requires local access to exploit and can be triggered by running the dwg2dxf tool with a malicious DWG file in binary mode. It was discovered through fuzzing and detected by AddressSanitizer. A patch has been released in version 0.14.8396 to fix this issue by correcting the buffer size handling.

Useful 0 Not Useful 0

Compliance Impact

The provided context and resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can lead to a heap-based buffer overflow, which may cause application crashes or potentially allow an attacker to execute arbitrary code or corrupt memory. Since the attack requires local access, an attacker would need to have some level of access to the system to trigger the vulnerability.

The impact includes possible denial of service due to crashes and potential escalation of privileges or code execution if the overflow is leveraged effectively.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to reproduce the heap-buffer-overflow condition using the dwg2dxf tool with a specially crafted DWG R2004 input file in binary mode.

A practical detection method involves running the following command on a suspicious or test DWG file to check for crashes or abnormal behavior:

• dwg2dxf --binary <crafted_input_file.dwg>

Using AddressSanitizer or similar memory error detection tools during this test can help identify the heap-buffer-overflow triggered by malformed input.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the affected LibreDWG component to version 0.14.8396 or later, which contains the patch fixing this vulnerability.

The patch removes the incorrect buffer size reassignment that caused the heap overflow, ensuring safe decompression of R2004 sections.

Since the exploit requires local access, restricting access to the vulnerable tool and avoiding processing untrusted DWG files can also reduce risk until the upgrade is applied.

Useful 0 Not Useful 0