Out-of-Bounds Write Vulnerability in Biosig Package Leading to Arbitrary Code Execution
Summary
DEBIAN-CVE-2024-23305: An out-of-bounds write vulnerability exists in the BrainVisionMarker Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). Affects biosig versions < 2.6.0-1. Fixed in 2.6.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Biosig Project provides a library called libbiosig, which is designed for parsing and processing various bio-signal data formats. It is widely used in research and applications involving brain signal analysis. The package is available in Debian distributions, specifically versions 13 and 14. The functionality of libbiosig includes handling BrainVisionMarker files, which are essential for interpreting brain signal data. However, a critical vulnerability has been identified that could allow attackers to exploit this functionality.
Vulnerability Detail
An out-of-bounds write vulnerability exists in the BrainVisionMarker Parsing functionality of the Biosig Project's libbiosig version 2.5.0 and the Master Branch (commit ab0ee111). This vulnerability can be triggered by a specially crafted .vmrk file, leading to arbitrary code execution. An attacker can exploit this vulnerability by providing a malicious file, potentially compromising the system's integrity and confidentiality.
How To Fix
Minimum fixed version
2.6.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade biosigTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening untrusted .vmrk files until the package is updated. Additionally, implementing file validation checks before processing can help mitigate the risk of exploitation.
Conclusion
The out-of-bounds write vulnerability in the Biosig package poses a significant risk, allowing for arbitrary code execution through malicious .vmrk files. It is crucial for users to update to the patched version 2.6.0-1 to safeguard their systems. Until then, users should exercise caution when handling potentially harmful files.
See every vulnerability recorded for biosig →
FAQ
The vulnerability is an out-of-bounds write issue that can lead to arbitrary code execution when processing malicious .vmrk files.
The affected versions are libbiosig 2.5.0 and the Master Branch (commit ab0ee111).
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
As a workaround, avoid processing untrusted .vmrk files and implement validation checks to minimize risk.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-23305.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for biosig.
