Headline
CVE-2023-32324: Heap buffer overflow in cupsd
OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function format_log_line could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file cupsd.conf sets the value of loglevelto DEBUG. No known patches or workarounds exist at time of publication.
Summary
A heap buffer overflow vulnerability would allow a remote attacker to lauch a dos attack.
Details
A buffer overflow vulnerability in the function format_log_line could allow remote attackers to cause a denial-of-service(DoS) on the affected system (not verified for possible arbitrary code execution).
The vulnerability affects the commit #c0c4037 and the latest commit #4310a07 on the GitHub master branch as well as the latest release version v2.4.2. I have only tested these versions so far.
Exploitation of the vulnerability can be triggered when the configuration file cupsd.conf sets the value of loglevel to DEBUG.
Please refer to the ASAN information for the location of the vulnerability:
Reproduce
git clone https://github.com/OpenPrinting/cups.git cd cups ./configure -with-tls=no CC=clang CXX=clang+ --disable-shared
Then modify the Makedef
add "-fPIE" to CFLAGS CXXFLAGS
add asan option like "-g -fsanitize=address" to CFLAGS CXXFLAGS LDFALGS
Now complile cups
make -j
We then use make test to get the configuration file, or use the default cupsd.conf in ./conf/ directory (but remember to change loglevel)
make test # or timeout -k 0 --preserve-status 1m make test
Run cups and replay the crash.raw
./scheduler/cupsd -c /tmp/cups-ubuntu/cupsd.conf -f
# or /scheduler/cupsd -c ./conf/cupsd.conf -f # bug remember to change the log level in conf
nc 127.0.0.1 8631 < ./crash.raw
PoC
Sorry I couldn’t upload the zip and the original packet, so I changed the suffix to jpg.
But github doesn’t seem to change the jpg file, so you can just replay this jpg file, which I tested.
Impact
Heap buffer overflow.
Related news
Red Hat Security Advisory 2024-1409-03 - An update for cups is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Issues addressed include buffer overflow, denial of service, and use-after-free vulnerabilities.
Gentoo Linux Security Advisory 202402-17 - Multiple vulnerabilities have been discovered in CUPS, the worst of which can lead to arbitrary code execution. Versions greater than or equal to 2.4.7 are affected.
Red Hat Security Advisory 2023-7165-01 - An update for cups is now available for Red Hat Enterprise Linux 8. Issues addressed include buffer overflow, denial of service, and use-after-free vulnerabilities.
Ubuntu Security Notice 6128-2 - USN-6128-1 fixed a vulnerability in CUPS. This update provides the corresponding update for Ubuntu 16.04 ESM. It was discovered that CUPS incorrectly handled logging. A remote attacker could use this issue to cause CUPS to crash, resulting in a denial of service, or possibly execute arbitrary code.
Ubuntu Security Notice 6128-1 - It was discovered that CUPS incorrectly handled logging. A remote attacker could use this issue to cause CUPS to crash, resulting in a denial of service, or possibly execute arbitrary code.