CVE-2021-3548
📋 TL;DR
CVE-2021-3548 is a buffer overflow vulnerability in dmg2img versions through 20170502 where improper validation of read buffer size during memcpy() can leak memory layout information. This information disclosure could potentially be leveraged as part of an exploit chain to achieve code execution. Users who process untrusted DMG files with vulnerable dmg2img versions are affected.
💻 Affected Systems
- dmg2img
📦 What is this software?
Dmg2img by Dmg2img Project
⚠️ Risk & Real-World Impact
Worst Case
Memory layout information disclosure combined with other vulnerabilities could lead to remote code execution when processing malicious DMG files.
Likely Case
Information disclosure revealing memory addresses that could aid in bypassing ASLR protections for subsequent attacks.
If Mitigated
Limited impact if system has proper memory protections (ASLR, DEP) and dmg2img isn't processing untrusted files.
🎯 Exploit Status
Exploitation requires user to process a malicious DMG file. The vulnerability alone provides information disclosure, not direct code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 20170502 (check specific distribution packages)
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=1959585
Restart Required: No
Instructions:
1. Check your distribution's security updates. 2. Update dmg2img package using your package manager. 3. For source installations, download and compile latest version from official repository.
🔧 Temporary Workarounds
Avoid processing untrusted DMG files
allDo not use dmg2img to convert DMG files from untrusted sources.
Use alternative tools
allUse other DMG extraction tools that are not vulnerable.
🧯 If You Can't Patch
- Restrict dmg2img usage to trusted users only
- Implement strict file validation before processing DMG files
🔍 How to Verify
Check if Vulnerable:
Check dmg2img version: dmg2img --version or rpm -q dmg2img or dpkg -l dmg2imgCheck Version:
dmg2img --version 2>&1 | head -1Verify Fix Applied:
Verify installed version is newer than 20170502 and check for security updates in package manager.📡 Detection & Monitoring
Log Indicators:
- Unusual dmg2img process execution patterns
- Multiple failed DMG conversion attempts
Network Indicators:
- N/A - local tool execution
SIEM Query:
process.name == "dmg2img" AND process.cmd_line CONTAINS ".dmg"