Multiple memory corruption vulnerabilities in Ghostscript

Bug #546009 reported by Dan Rosenberg on 2010-03-24
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Fix Released
ghostscript (Ubuntu)
Rahmadani bayu aji

Bug Description

Binary package hint: ghostscript

I have discovered multiple memory corruption vulnerabilities in Ghostscript, which can be triggered when using Ghostscript to view maliciously crafted PostScript files.

1. The Ghostscript interpreter fails to properly handle some cases of infinite recursion. By creating a .ps file with a sequence such as:

/A{pop 0 A 0} bind def
/product A 0

The interpreter's internal stack will be overflowed with recursive calls. Rather than gracefully handling this situation, the interpreter continues execution by jumping to an (usually invalid) address near (or past) the tail end of the stack. Without further manipulation, this would simply result in a segfault, but it turns out that by altering the number of variable definitions that occur before the call to the infinitely recursive procedure, the user can actually exert control over the address that is jumped to. Combined with the fact that the attacker has an easy way to introduce shellcode (via the .ps file), this can definitely result in arbitrary code execution. I have not developed a fully functional exploit for this case, but the attached reproducer ("") will trigger a segfault in the same location on all of the versions of Ghostscript I have tested, including 8.61, 8.62, 8.64, and 8.70. If you wish to more convincingly verify that this is exploitable, place varying amounts of "/A{ 0 } bind def" strings at the beginning of the file, and observe how the EIP at crash time is altered. Unfortunately, the Ghostscript code is rather complex, so I am unable to determine the root cause of this vulnerability in the source.

2. Ghostscript fails to properly parse very long identifiers, leading to memory corruption and potentially arbitrary code execution. The resulting behavior depends on the version of Ghostscript. I have found that 8.61 (Hardy) is not vulnerable. However, 8.64 (Jaunty) is vulnerable and exploitable. I haven't been able to pin down the exact cause for the overflow, but the exploitable memory access occurs in gc_objects_clear_marks(), in psi/igc.c, when *(pre + 1) is called as a function. 8.70 (Karmic) is also vulnerable to an overflow when parsing very long identifiers, but this time, rather than an invalid (exploitable) function pointer call, the issue is a classic stack overflow. The overflow occurs due to a bad memcpy() call in dynamic_save(), called in scan_token() in psi/iscan.c at line 1061. Successful exploitation is mitigated by SSP - it catches the overflow and terminates - so on Karmic this should only result in denial of service.

The attached reproducer ("") will trigger overflows in both 8.64 and 8.70 due to the different reasons described above.

Dan Rosenberg (dan-j-rosenberg) wrote :

Note that since Ghostscript is invoked by CUPS, this may provide a means of privilege escalation, but I have not thoroughly investigated this.

Kees Cook (kees) wrote :

The good news with CUPS is that by default it is confined by AppArmor, limiting the exposure. Still, jumping to a controllable address is bad. :)

Kees Cook (kees) on 2010-04-09
description: updated
Kees Cook (kees) on 2010-04-09
Changed in ghostscript (Ubuntu):
status: New → Confirmed
importance: Undecided → Medium
visibility: private → public
K v K (zappe) wrote :

Is this vulnerability present in 8.71 too?

Changed in gs-gpl:
status: Unknown → Invalid
Changed in gs-gpl:
status: Invalid → Unknown
Changed in gs-gpl:
status: Unknown → Confirmed
Dan Rosenberg (dan-j-rosenberg) wrote :

8.71 is not vulnerable to the first bug (stack overflow in token parsing), but is vulnerable to the second (infinite recursion memory corruption).

Kees Cook (kees) wrote :

Hi Dan, where does this bug stand with upstream? Is there a CRD for it, or is it public now? Thanks!

Marc Deslauriers (mdeslaur) wrote :

Ok, so issue #2 (infinite recursion, dynamic_save) is fixed with 8.71 and is CVE-2010-1869.

Issue #1 does affect 8.71, and is CVE-2010-1628.

Changed in gs-gpl:
status: Confirmed → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ghostscript - 8.71.dfsg.1-0ubuntu5.2

ghostscript (8.71.dfsg.1-0ubuntu5.2) lucid-security; urgency=low

  * SECURITY UPDATE: arbitrary code execution via unlimited recursive
    procedure invocations (LP: #546009)
    - debian/patches/CVE-2010-1628.dpatch: only initialize structures if
      all allocations were successful in psi/ialloc.c, psi/idosave.h,
    - CVE-2010-1628
 -- Marc Deslauriers <email address hidden> Fri, 09 Jul 2010 08:06:19 -0400

Changed in ghostscript (Ubuntu):
status: Confirmed → Fix Released
Changed in gs-gpl:
status: Fix Released → Confirmed
Changed in gs-gpl:
importance: Unknown → Critical
Changed in gs-gpl:
status: Confirmed → Fix Released
Changed in ghostscript (Ubuntu):
assignee: nobody → Skymathrix (asstaroid)
To post a comment you must log in.
This report contains Public Security information  Edit
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.