Bug 2293958 (CVE-2024-33869)

Summary: CVE-2024-33869 ghostscript: path traversal and command execution due to path reduction
Product: [Other] Security Response Reporter: Robb Gatica <rgatica>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: ghostscript 10.03.1 Doc Type: ---
Doc Text:
A flaw was found in Ghostscript. In certain circumstances, path reduction in the "gp_validate_path_len" function may allow path traversal or possible command execution.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2296285    
Bug Blocks: 2278776    

Description Robb Gatica 2024-06-24 15:54:34 UTC
The function "gp_validate_path_len" first tests if the path has a cwd prefix and then reduces the path.

In the case of a path like "./../tmp/aa" it will first see that it has a cwd prefix and then reduce it to "../tmp/aa". When validation fails, it tries the variant without the cwd prefix by skipping the first two characters. But this will skip the ".." and validate "/tmp/aa", which is an allowed path (on Linux).

References:
https://ghostscript.readthedocs.io/en/gs10.03.1/News.html
https://bugs.ghostscript.com/show_bug.cgi?id=707691

Upstream commits:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=5ae2e320d69a7d0973011796bd388cd5befa1a43
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f5336e5b4154f515ac83bc5b9eba94302e6618d4

Comment 2 errata-xmlrpc 2024-09-03 10:24:55 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:6197 https://access.redhat.com/errata/RHSA-2024:6197

Comment 3 errata-xmlrpc 2024-09-09 01:31:32 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:6466 https://access.redhat.com/errata/RHSA-2024:6466