CVE-2022-46663

Vulnerability

In GNU Less versions 566 through 608 (the latest public release before 609), the -R option intended to pass through raw ANSI escape sequences for proper rendering fails to correctly handle terminal state machine transitions. This allows crafted data to inject escape sequences that bypass the intended filtering. The issue affects less downstream packages, such as sys-apps/less on Gentoo before version 608-r2 [4]. The fix commit a78e1351113cef564d790a730d657a321624d79c [1][2] has been applied upstream but was not part of any formal release at the time of disclosure.

Exploitation

An attacker can craft a file containing specially designed escape sequences that exploit the incomplete state machine handling. For example, executing printf "\e]8;;\e0m\e[>0q" > less-example-xtversion; less -R less-example-xtversion triggers a response from the terminal (e.g., xterm or iTerm2) that causes Less to repeatedly scroll and print output, leading to a denial-of-service condition [1][2]. No special privileges or user interaction beyond opening the crafted file in Less with -R is required.

Impact

Successful exploitation results in denial of service: the terminal may be flooded with repeated scrolling and output, consuming system resources and rendering the terminal session unusable. Depending on the terminal emulator, the attack could also clear the terminal screen or manipulate displayed content, potentially tricking the user into seeing misleading information [4]. The vulnerability does not appear to allow arbitrary code execution or persistent data compromise.

Mitigation

A fix has been committed to the upstream Less repository (commit a78e1351113cef564d790a730d657a321624d79c) but not yet released in a stable version [1][2]. As a workaround, users should avoid using the -R option when viewing untrusted files, or upgrade to the patched version when available. Distribution-specific updates may be provided; for example, Gentoo has released version 608-r2 as the unaffected version [4]. No workarounds other than not using -R with untrusted input are known at this time.