CVE-2021-33479
📋 TL;DR
A stack-based buffer overflow vulnerability exists in gocr's measure_pitch() function in pgm2asc.c. This allows attackers to execute arbitrary code or cause denial of service by providing specially crafted PGM image files. Users of gocr for optical character recognition are affected.
💻 Affected Systems
- gocr
📦 What is this software?
Optical Character Recognition by Optical Character Recognition Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the gocr process, potentially leading to full system compromise.
Likely Case
Denial of service through application crash when processing malicious image files.
If Mitigated
Limited impact if gocr runs in sandboxed environment with minimal privileges.
🎯 Exploit Status
Exploitation requires providing a malicious PGM file to gocr. Public bug reports include technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 0.53-20200802
Vendor Advisory: https://security.gentoo.org/glsa/202401-28
Restart Required: No
Instructions:
1. Update gocr package using system package manager. 2. For Gentoo: emerge --sync && emerge -av gocr. 3. For Red Hat-based: yum update gocr. 4. For source builds: Download latest version from SourceForge.
🔧 Temporary Workarounds
Disable PGM processing
linuxRemove or restrict access to gocr binary to prevent processing of PGM files.
chmod 000 /usr/bin/gocr
mv /usr/bin/gocr /usr/bin/gocr.disabled
Input validation
allImplement file type validation before passing images to gocr.
🧯 If You Can't Patch
- Run gocr in containerized/sandboxed environment with minimal privileges.
- Implement strict access controls to limit which users can execute gocr.
🔍 How to Verify
Check if Vulnerable:
Check gocr version: gocr --version 2>&1 | head -1Check Version:
gocr --version 2>&1 | grep -o '[0-9]\+\.[0-9]\+.*'Verify Fix Applied:
Verify version is newer than 0.53-20200802 and test with known safe PGM files.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or crash logs from gocr process
- Unexpected process termination
Network Indicators:
- Unusual outbound connections from gocr process if exploited
SIEM Query:
process_name:"gocr" AND (event_type:"crash" OR exit_code:139)