Heap-buffer-overflow in bit_read_RC in libredwg
Summary
OSV-2023-1104: Heap-buffer-overflow in bit_read_RC. Affects libredwg versions >= 4b39dcf8147c25b9eceb85c2ffdfca4afe677551, < e75d7796000df64e0adc308ef851ac4fccffa4bd. Fixed in e75d7796000df64e0adc308ef851ac4fccffa4bd. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libredwg is an open-source library that provides functionality for reading and writing DWG files, which are the native file format for AutoCAD. It is widely used in various applications that deal with CAD drawings. However, a vulnerability has been discovered in the library that can lead to a heap-buffer-overflow when reading certain bits.
Vulnerability Detail
The vulnerability in libredwg, specifically in the bit_read_RC function, allows for a heap-buffer-overflow read of 1 byte. This can result in a crash or potentially be exploited by an attacker to execute arbitrary code. The issue has been reported through the OSS-Fuzz project and has been assigned a medium severity level.
How To Fix
Minimum fixed version
e75d7796000df64e0adc308ef851ac4fccffa4bd
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can implement input validation and bounds checking when using the affected function. By ensuring that the input is within the expected range, the risk of triggering the heap-buffer-overflow can be mitigated. Here is an example of how input validation can be implemented in C:
void read_RC(int value) {
if (value >= 0 && value < MAX_VALUE) {
// Perform the read operation
}
}
Conclusion
In conclusion, libredwg is vulnerable to a heap-buffer-overflow in the bit_read_RC function. This can potentially lead to a crash or code execution. It is recommended to update to a patched version of the library to mitigate this vulnerability. If you have further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libredwg →
FAQ
libredwg is an open-source library for reading and writing DWG files, the native file format for AutoCAD. It is used in various applications that deal with CAD drawings.
A heap-buffer-overflow occurs when a program reads or writes data beyond the bounds of a dynamically allocated buffer in the heap. In this case, the bit_read_RC function in libredwg reads more data than it should, potentially leading to a crash or code execution.
If an attacker can control the input to the bit_read_RC function, they can craft a malicious input that triggers the heap-buffer-overflow. This can potentially allow the attacker to execute arbitrary code or crash the application.
This vulnerability has been assigned a medium severity level. While it can lead to a crash or code execution, it requires control over the input to the affected function.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for libredwg.
