CVE-2024-58392 icculus CVE debrief

Who should care

Defenders responsible for systems using the PhysicsFS library, particularly those handling archive files, should assess exposure and prioritize patching and monitoring. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify affected versions, assess exposure, and apply patches or mitigations to prevent potential application crashes and information disclosure.

Why it matters

Defenders should care about CVE-2024-58392 because it allows attackers to cause out-of-bounds reads and potential crashes in applications using PhysicsFS through version 3.2.0. This vulnerability can be exploited through crafted archive files, making it a concern for systems handling such files. The impact includes potential application crashes and information disclosure. Defenders should verify affected versions, assess exposure, and prioritize patching.

• Potential application crashes due to crafted archives
• Information disclosure through out-of-bounds reads
• Denial of service through targeted attacks
• Need for verification of affected versions and exposure

Technical summary

The __PHYSFS_utf8codepoint() function in PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability. This is caused by an off-by-one cursor advance on six-octet UTF-8 sequences, allowing attackers to read past name buffers via crafted archive entry names. The vulnerability can cause PHYSFS_utf8stricmp() and hashing to over-read and crash the application. Affected product deployments should be verified, and patches applied to prevent potential application crashes and information disclosure through crafted archives.

Defensive priority

Defenders should prioritize verifying and applying patches for PhysicsFS versions up to 3.2.0, assessing exposure in systems using this library, and monitoring for potential crashes caused by crafted archives.

Recommended defensive actions

• Verify and apply patches for PhysicsFS versions up to 3.2.0
• Assess exposure in systems using PhysicsFS library
• Monitor for potential crashes caused by crafted archives
• Inventory and update affected systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on an out-of-bounds read vulnerability in PhysicsFS through 3.2.0. The vulnerability is caused by an off-by-one cursor advance on six-octet UTF-8 sequences in the __PHYSFS_utf8codepoint() function. This allows attackers to read past name buffers via crafted archive entry names.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.