A vulnerability (CVE-2023-43641) has been discovered in the libcue library, which is used to parse metadata regarding the order and duration of audio tracks. This vulnerability allows for remote code execution when processing specially crafted cue files. The library is used in several multimedia players and audio editors, including Audacious, and can be exploited to compromise systems when unverified data is opened in them.
Furthermore, the libcue library is utilized in the tracker-miners search engine, which is deployed in the GNOME user environment. Since tracker-miners automatically index new multimedia files in the home directory, an attacker can execute code on systems with GNOME simply by having the user download a specially crafted file to the ~/Downloads, ~/Music, or ~/Videos directories, without the need to open it (for example, in some cases, it is enough just to click a link in the browser).
The researchers who discovered the vulnerability have prepared a working exploit and demonstrated its ability to exploit environments based on Ubuntu 23.04 and Fedora 38. The exploit code will be published later to allow users time to apply the update that fixes the vulnerability. The exploit is stable in operation but requires adaptation for each distribution.
The vulnerability is caused by an integer overflow in the code that parses the INDEX parameter and manifests when excessively large numeric values that do not fit the 'int' type are specified for this parameter. The atoi function is used to convert the string to a number; for example, specifying the number 4294567296 results in a conversion to -400000. The vulnerability arises from the lack of checking the obtained value to ensure it cannot be negative. As a result, the code performs an operation 'track->index[i] = ind' after the atoi conversion, where 'i' can be assigned a negative number to overwrite memory outside the buffer with the value 'ind', which is also loaded from the processed file.
In most distributions with GNOME, the tracker-miners component is enabled by default and loads as a hard dependency for the Nautilus file manager (GNOME Files). To disable tracker-miners for the current user, you can use the following commands: systemctl —user mask tracker-store.service tracker-miner-fs.service tracker-miner-rss.service tracker-extract.service tracker-miner-apps.service tracker-writeback.service tracker reset —hard
Source: opennet.ru
