CVE-2024-29508

Vulnerability

CVE-2024-29508 is a heap-based pointer disclosure vulnerability in Artifex Ghostscript prior to version 10.03.0. The issue resides in the pdf_base_font_alloc function, where a constructed BaseFont name can be used to leak heap pointers. This affects all versions before the fix was introduced in 10.03.0.

Exploitation

An attacker can exploit this by crafting a PostScript file that invokes the PDF interpreter with a specially crafted BaseFont name. The attacker does not require authentication but needs to deliver the malicious file to the target system, either via user interaction (e.g., opening a document) or through automated processing (e.g., a document conversion service). The heap pointer is observable in the exported BaseFont name.

Impact

Successful exploitation leads to disclosure of heap memory addresses, which can aid in bypassing security mechanisms such as ASLR. This information leakage may be a precursor to more severe attacks, though the disclosure itself does not grant code execution or direct data access.

Mitigation

The vulnerability is fixed in Ghostscript version 10.03.0, released approximately four months prior to the publication date. Users should upgrade to 10.03.0 or later. No workaround is documented [1] [2]. The fix has been incorporated into most Linux distributions' package repositories [1].