CVE-2021-40589
📋 TL;DR
CVE-2021-40589 is an integer underflow vulnerability in ZAngband's zangband-data 2.7.5 that occurs when processing bitmap file headers. This allows attackers to execute arbitrary code or cause denial of service by exploiting the underflow in the fileheader.bfOffBits variable. Users running ZAngband with zangband-data 2.7.5 are affected.
💻 Affected Systems
- ZAngband
- zangband-data
📦 What is this software?
Zangband Data by Zangband Data Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash (denial of service) or limited memory corruption leading to unstable behavior.
If Mitigated
Application crash with no privilege escalation if proper sandboxing and memory protections are enabled.
🎯 Exploit Status
Exploitation requires crafting malicious bitmap files and convincing users to load them in ZAngband.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: zangband-data 2.7.6 or later
Vendor Advisory: https://sourceforge.net/p/zangband/bugs/671/
Restart Required: Yes
Instructions:
1. Download latest zangband-data from SourceForge. 2. Replace existing zangband-data files. 3. Restart ZAngband.
🔧 Temporary Workarounds
Disable bitmap file loading
linuxPrevent ZAngband from loading external bitmap files
chmod 000 ~/.zangband/*.bmp
chmod 000 /usr/share/zangband/*.bmp
Run with memory protection
linuxEnable ASLR and other memory protections
sysctl -w kernel.randomize_va_space=2
🧯 If You Can't Patch
- Isolate ZAngband in a sandboxed environment or virtual machine
- Restrict file permissions to prevent loading of untrusted bitmap files
🔍 How to Verify
Check if Vulnerable:
Check zangband-data version: grep 'Version' /usr/share/zangband/README or check installed package versionCheck Version:
grep -i version /usr/share/zangband/README 2>/dev/null || echo 'Check package manager for zangband-data version'Verify Fix Applied:
Verify zangband-data version is 2.7.6 or later📡 Detection & Monitoring
Log Indicators:
- ZAngband crash logs with memory access violations
- Unexpected bitmap file loading attempts
Network Indicators:
- None - this is a local file processing vulnerability
SIEM Query:
process_name:"zangband" AND (event_type:"crash" OR event_type:"access_violation")