Heap-use-after-free vulnerability in ghostscript
Summary
OSV-2024-251: Heap-use-after-free in gx_device_forward_finalize. Affects ghostscript versions >= 441c9e3a4ca08fa7f7c00063af33196b0d88ebaf, < 5fb7114f814645ebf679a8228350e9770bf3f009. Fixed in 5fb7114f814645ebf679a8228350e9770bf3f009. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. This vulnerability affects the gx_device_forward_finalize function in Ghostscript, which is responsible for finalizing a forward device. The vulnerability allows an attacker to exploit a heap-use-after-free condition, potentially leading to arbitrary code execution or a denial of service.
Vulnerability Detail
The vulnerability originates from a heap-use-after-free read of 8 bytes. The crash occurs in the gx_device_forward_finalize function, which is called during the finalization process of a forward device. The specific crash state involves gx_device_finalize and gs_gc_reclaim. An attacker can potentially exploit this vulnerability to read sensitive information from the heap or execute arbitrary code with the privileges of the Ghostscript process.
How To Fix
Minimum fixed version
5fb7114f814645ebf679a8228350e9770bf3f009
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At the moment, there is no known workaround for this vulnerability. It is advised to apply the official fix or update to a patched version of Ghostscript as soon as possible.
Conclusion
In conclusion, the heap-use-after-free vulnerability in Ghostscript can potentially lead to arbitrary code execution or a denial of service. It is crucial to update Ghostscript to a patched version or apply the official fix provided by the project. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
A heap-use-after-free vulnerability occurs when a program attempts to access memory that has already been freed. This can lead to crashes, memory corruption, and potentially arbitrary code execution.
An attacker can exploit this vulnerability by crafting a malicious document or file that triggers the heap-use-after-free condition in Ghostscript. By exploiting this vulnerability, the attacker may be able to execute arbitrary code or cause a denial of service.
The recommended mitigation is to update Ghostscript to a version that includes the fix for this vulnerability. It is important to keep software up to date and follow best practices for secure coding and deployment.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in software.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
