A vulnerability classified as problematic was found in libpff. This vulnerability affects the function libpff_item_tree_create_node of the file libpff_item_tree.c. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect availability. CVE summarizes:

libpff_item_tree_create_node in libpff_item_tree.c in libpff before experimental-20180714 allows attackers to cause a denial of service (infinite recursion) via a crafted file, related to libfdata_tree_get_node_value in libfdata_tree.c.

The bug was discovered 10/10/2017. The weakness was released 12/22/2018 (Website). The advisory is shared for download at github.com. This vulnerability was named CVE-2018-20348 since 12/21/2018. The attack needs to be approached locally. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 437 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version experimental-20180714 eliminates this vulnerability.

Productinfo

Name

• libpff

Version

• 20180623
• <=2018-04-28

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion