Bug 706494

Created attachment 23886 [details]
This zip archive includes three POC for GhostScript version 9.55.0 pulled from the package manager on ubuntu, GhostScript 10.0.0 and 10.01.0, compiled from source on Debian

Hi,

I found an exploitable buffer overflow in the s_xBCPE_process (called by both BCPEncode and TBCPEncode filter), which seems to impact many version of GhostScript interpreter. Within the s_xBCPE_process, it is possible to ends up with the write pointer (q, in the code) greater than the write limit pointer (pw->limit). This can be achieved by trying to write more data than the target source can handle, and passing an escaped character as the last writable character.

The issue can be easily seen in debug mode (-Zs), with the following POC:


/writtenTo {4 string} def 
/ourFilter writtenTo /BCPEncode filter def 
/readsFrom <414141134141> def
ourFilter readsFrom writestring
ourFilter flushfile


After the write, to the filter, the debug statement should print:


[s]write process 0x560dc8218ba8(stream_state), nr=6, nw=4, end=0
[s]after write 0x560dc8218ba8, nr=2, nw=4294967295, end=0, status=1


The nw=4294967295 indicates that the pw->limit - pw->ptr operation overflowed. Any subsequent write to the filter will not be bounded.


This can be exploited by chaining two filter together, as demonstrated in the attached POC. The out of bound write will overwrite the current stream structure, allowing an attacker to craft handy arbitrary read and arbitrary write primitive or simply hijack a function pointer within the proc structure. With those primitive, it is possible to disable the sandbox by overwriting the path_control_active variable, and execute code on the victim machine.


I attached three POC, one for Ubuntu 22.04.2 GhostScript package (which is GhostScript 9.55), one for Debian with GhostScript version 10.0.0 compiled from source, and for Debian for GhostScript version 10.01.0, compiled from source. For any of those POC, the result should look like :


./gs -dSAFER -f debian10.01.0.ps 
GPL Ghostscript 10.01.0 (2023-03-22)
Copyright (C) 2023 Artifex Software, Inc.  All rights reserved.
This software is supplied under the GNU AGPLv3 and comes with NO WARRANTY:
see the file COPYING for details.
Found leak: 0x000055C5BA2A6D67
Null filter address will be @ 0x55C5BA2DB558
read cursor address -1 should be @ 0x55C5BA2DB5C7
context addr @ 0x000055C5B9FB0BD8
path_control addr @ 0x55C5B9FAE5BA
GS<1>uid=1000(debian) gid=1000(debian) groups=1000(debian) [...]


As the escaped character in BCPEncode or TBCPEncode can not be written (at least with my POC) you may need to restart to exploit to get a correct ASRL layout. Furthermore, as describe in the POC, you may need to change the offset between the leak we get and the NullFilter created after.


For the remediation, I'm no C nor GhostScript expert, but I guess the s_xBCPE_process should check if incrementing twice the write pointer (q) does not result in q > pw->limit.


I stay at your disposition for any additional information.

Thanks,
Hadrien.