CVE-2021-3888
📋 TL;DR
CVE-2021-3888 is a use-after-free vulnerability in libmobi, a library for handling MOBI eBook files. Attackers can exploit this by crafting malicious MOBI files to cause arbitrary code execution or denial of service. Applications using vulnerable versions of libmobi to process untrusted MOBI files are affected.
💻 Affected Systems
- libmobi
📦 What is this software?
Libmobi by Libmobi Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the application processing the MOBI file, potentially leading to complete system compromise.
Likely Case
Application crash (denial of service) when processing malicious MOBI files, potentially disrupting services that handle eBook files.
If Mitigated
Limited to denial of service if proper sandboxing or privilege separation is implemented.
🎯 Exploit Status
Exploitation requires the victim to process a malicious MOBI file. Proof-of-concept code is available in public repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit c78e186739b50d156cb3da5d08d70294f0490853
Vendor Advisory: https://github.com/bfabiszewski/libmobi/commit/c78e186739b50d156cb3da5d08d70294f0490853
Restart Required: No
Instructions:
1. Update libmobi to version including commit c78e186739b50d156cb3da5d08d70294f0490853
2. Recompile any applications using libmobi
3. Replace existing libmobi installations with patched version
🔧 Temporary Workarounds
Disable MOBI file processing
allTemporarily disable processing of MOBI files in affected applications until patched
Sandbox file processing
linuxRun applications that process MOBI files in isolated containers or with reduced privileges
docker run --read-only --cap-drop=ALL -v /tmp:/tmp:ro application
🧯 If You Can't Patch
- Implement strict file upload validation to reject suspicious MOBI files
- Use application allowlisting to prevent execution of untrusted applications that might process MOBI files
🔍 How to Verify
Check if Vulnerable:
Check libmobi version or commit hash against vulnerable versions. Use: strings /path/to/libmobi.so | grep 'libmobi'Check Version:
pkg-config --modversion libmobi 2>/dev/null || echo 'libmobi not found via pkg-config'Verify Fix Applied:
Verify the installed libmobi includes commit c78e186739b50d156cb3da5d08d70294f0490853📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing MOBI files
- Memory access violation errors in application logs
Network Indicators:
- Unusual file uploads of MOBI files to web applications
- Multiple failed file processing attempts
SIEM Query:
source="application.log" AND ("segmentation fault" OR "access violation") AND "mobi"🔗 References
- https://github.com/bfabiszewski/libmobi/commit/c78e186739b50d156cb3da5d08d70294f0490853
- https://huntr.dev/bounties/722b3acb-792b-4429-a98d-bb80efb8938d
- https://github.com/bfabiszewski/libmobi/commit/c78e186739b50d156cb3da5d08d70294f0490853
- https://huntr.dev/bounties/722b3acb-792b-4429-a98d-bb80efb8938d
