CVE-2021-42613
📋 TL;DR
CVE-2021-42613 is a double-free vulnerability in Halibut's cleanup_index function that allows attackers to cause denial of service or potentially execute arbitrary code by processing a specially crafted text document. This affects users who process untrusted documents with Halibut 1.2. The vulnerability stems from improper memory management when handling malformed input.
💻 Affected Systems
- Halibut
📦 What is this software?
Fedora by Fedoraproject
Halibut by Halibut Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if the double-free can be leveraged for memory corruption attacks.
Likely Case
Denial of service through application crash when processing malicious documents.
If Mitigated
Limited to denial of service if memory corruption cannot be reliably exploited for code execution.
🎯 Exploit Status
Proof-of-concept exists demonstrating the double-free condition. Exploitation requires crafting a specific text document that triggers the vulnerability when processed by Halibut.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Halibut 1.3 or later
Vendor Advisory: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CC7UZ7NRXDA7YSCSGWE2CBQM7OZS3K2R/
Restart Required: Yes
Instructions:
1. Upgrade Halibut to version 1.3 or later. 2. Recompile any applications using Halibut. 3. Restart services using Halibut.
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation for text documents processed by Halibut
Memory Sanitizer
linuxCompile Halibut with address sanitizer (ASAN) to detect and prevent double-free conditions
gcc -fsanitize=address -o halibut index.c
🧯 If You Can't Patch
- Isolate Halibut processing to dedicated, non-privileged containers or VMs
- Implement strict file upload controls and sandbox document processing
🔍 How to Verify
Check if Vulnerable:
Check Halibut version: halibut --version | grep '1.2'Check Version:
halibut --versionVerify Fix Applied:
Verify Halibut version is 1.3 or later: halibut --version📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Memory corruption errors in system logs
- Unexpected process termination of Halibut
Network Indicators:
- Unusual document uploads to systems using Halibut
- Patterns of failed document processing requests
SIEM Query:
process_name:"halibut" AND (event_type:"crash" OR exit_code:139)🔗 References
- https://carteryagemann.com/halibut-case-study.html#poc-halibut-winhelp-df
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CC7UZ7NRXDA7YSCSGWE2CBQM7OZS3K2R/
- https://carteryagemann.com/halibut-case-study.html#poc-halibut-winhelp-df
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CC7UZ7NRXDA7YSCSGWE2CBQM7OZS3K2R/
