CVE-2023-40295

Vulnerability

The heap-based buffer overflow vulnerability exists in the ur_strInitUtf8 function in string.c of the libboron library included with Boron 2.0.8 [1]. This bug can be triggered when processing specially crafted input that leads to memory corruption [1]. The library version affected is 2.0.8, as confirmed by the maintainer and the reproduction files [1].

Exploitation

An attacker can cause the heap buffer overflow by supplying a malformed .b file to the Boron interpreter [1]. The reference provides reproduction files that demonstrate the crash [1]. No authentication or special privileges are required; local access to run the binary against the malicious file is sufficient [1].

Impact

Successful exploitation leads to heap corruption, as evidenced by the malloc(): invalid size (unsorted) error and the crash observed in tests [1]. This could potentially be leveraged for arbitrary code execution or denial of service, though the reference does not confirm a specific exploit [1]. The crash was observed on both macOS and Linux x86_64 [1].

Mitigation

As of the latest available update, no official patched version has been released [1]. Users should monitor the project's repository for a fix [1]. Until a patch is available, avoid processing untrusted or malformed Boron input files [1].