CVE-2024-34459 – Buffer Over-read Vulnerability in xmllint (from libxml2) Affecting Versions Before 2.11.8 and 2.12.x Before 2.12.7

A critical security issue, identified as CVE-2024-34459, has been uncovered in the xmllint utility from the libxml2 library. This vulnerability affects all versions of libxml2 before 2.11.8 and 2.12.x before 2.12.7. The issue arises from improper handling of formatting error messages while using the --htmlout option in xmllint command, potentially leading to a buffer over-read in xmlHTMLPrintFileContext function present in xmllint.c. In this post, we will dive deeper into the cause of this vulnerability, the consequences, and the steps to mitigate the issue.

Vulnerability Details

xmllint, a part of the libxml2 library, is a popular command-line utility used to parse and validate XML files. One of the features of xmllint is the --htmlout option, which is utilized to format the error messages for more readable output when validating an HTML file.

The cause of the vulnerability lies in the xmlHTMLPrintFileContext function in the xmllint.c file. When formatting the error message with the specific input, a buffer over-read can occur, leading to undefined behavior. This could potentially lead to information disclosure, application crashes, or even remote code execution in some cases.

Here is a code snippet that exhibits the issue

static void
xmlHTMLPrintFileContext(xmlParserInputPtr input) {
    const xmlChar *cur, *base;
    int len;
    unsigned int n, col;  //<<<< 1. HERE
    
    if (input == NULL) return;
    base = input->base;
    cur = input->cur;
    col = input->col;
    len = input->length;
    
    while ((len > ) && ((*cur == xA) || (*cur == xD))) {
        cur++;
        len--;
        if (*cur == xA) {
            base = cur;
            break;
        }
    }
    n = ;
    while ((*cur != xA) && (*cur != xD) && (len > ) && (n++ < 60)) {
        printf("%c", (unsigned char) *cur);
        cur++;
        len--;  //<<<< 2. HERE
        col--;  //<<<< 3. HERE
    }
}

In the code above, the integer variables n and col are not checked for underflow, which could lead to issues if col is decremented to a value greater than the maximum allowed unsigned integer (step 3). Consequently, this can cause a buffer over-read in later parts of the function (step 2).

Exploit Details

Though a working exploit code is not provided in this post, it is important to understand that this vulnerability could potentially be used by an attacker to trigger an application crash or disclose sensitive information. The issue can be reliably triggered by crafting a malicious HTML file and feeding it as input to the xmllint command using the --htmlout option.

References

- Original CVE Details: https://nvd.nist.gov/vuln/detail/CVE-2024-34459
- Libxml2 Repository: https://gitlab.gnome.org/GNOME/libxml2
- xmllint Manual: http://xmlsoft.org/xmllint.html

Solution

To protect your systems from this vulnerability, it is strongly recommended to update your libxml2 library to the latest version (2.12.7 or later for the 2.12.x branch, or 2.11.8 or later for other branches). This can typically be done using your operating system’s package manager or by building and installing the library from source.

Conclusion

CVE-2024-34459 is a serious security issue affecting the xmllint utility from the libxml2 library. Updating your libxml2 installation to a version that contains a fix for this issue and removing any older, vulnerable versions, is crucial to ensure the security of your systems.

Timeline

Published on: 05/14/2024 15:39:11 UTC
Last modified on: 08/22/2024 18:35:08 UTC