CVE-2021-32435

Vulnerability

A stack-based buffer overflow exists in the get_key() function within parse.c of abcm2ps version 8.14.11. The root cause lies in set_k_acc(), where the arrays accs and pits are declared with a fixed size of 8, but the loop iterates nacc up to s->u.key.sf without bounds checking. If s->u.key.sf exceeds 7, out-of-bounds writes corrupt the stack. This can be triggered by processing a specially crafted ABC file [1].

Exploitation

An attacker can exploit this by crafting a malicious ABC file containing a key signature (K:) directive that sets the sf field to a value greater than 7. When abcm2ps processes this file using the -E option or similar, the vulnerable code path in set_k_acc() is reached, causing a stack buffer overflow. No authentication or special network position is required; the victim only needs to open the malicious file with the affected abcm2ps version [1].

Impact

Successful exploitation causes a denial of service (DoS) via program crash. The overflow corrupts the stack, including the stack canary, leading to __stack_chk_fail and termination. The extent of further impact (e.g., code execution) is not described in the available references, but the buffer overflow can corrupt adjacent memory [1].

Mitigation

The vulnerability was fixed in commit 3169ace [2], which adds a bounds check before writing to the arrays. Users should upgrade to a version containing this fix or apply the patch. There are no known workarounds for unpatched versions. Red Hat package announcements referenced [3][4] may indicate upcoming or released packages, but they are not accessible without bypassing a bot challenge.