CVE-2023-46751
📋 TL;DR
A use-after-free vulnerability in Ghostscript's gdev_prn_open_printer_seekable() function allows remote attackers to crash the application via a dangling pointer. This affects all systems running vulnerable versions of Ghostscript that process untrusted PostScript or PDF files. The vulnerability can be triggered by processing malicious documents.
💻 Affected Systems
- Artifex Ghostscript
📦 What is this software?
Ghostscript by Artifex
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if combined with other vulnerabilities, though this specific CVE primarily causes crashes.
Likely Case
Denial of service through application crashes when processing malicious documents, potentially disrupting document processing services.
If Mitigated
Limited to application crashes with proper sandboxing and input validation in place.
🎯 Exploit Status
Proof of concept available in bug reports. Exploitation requires sending a malicious document to be processed by Ghostscript.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.02.1 and later
Vendor Advisory: https://ghostscript.com/
Restart Required: Yes
Instructions:
1. Update Ghostscript to version 10.02.1 or later. 2. For Linux: Use package manager (apt-get update && apt-get upgrade ghostscript). 3. For Windows: Download latest installer from ghostscript.com. 4. Restart all services using Ghostscript.
🔧 Temporary Workarounds
Disable Ghostscript processing
allTemporarily disable Ghostscript-based document processing until patched
systemctl stop ghostscript-services
disable document conversion features in applications
Sandbox Ghostscript execution
linuxRun Ghostscript in a container or sandboxed environment
docker run --security-opt no-new-privileges ghostscript
Use SELinux/AppArmor policies
🧯 If You Can't Patch
- Implement strict input validation for all document uploads
- Isolate Ghostscript processes with minimal privileges and network access
🔍 How to Verify
Check if Vulnerable:
Run: gs --version | grep -q '10\.0[0-2]\.0' && echo 'VULNERABLE'Check Version:
gs --versionVerify Fix Applied:
Run: gs --version | grep -q '10\.02\.1' && echo 'PATCHED'📡 Detection & Monitoring
Log Indicators:
- Ghostscript crash logs
- Segmentation fault errors in system logs
- Abnormal process termination
Network Indicators:
- Multiple failed document processing requests
- Unusual document upload patterns
SIEM Query:
process_name:"gs" AND (event_type:"crash" OR exit_code:139)🔗 References
- https://bugs.ghostscript.com/show_bug.cgi?id=707264
- https://ghostscript.com/
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=dcdbc595c13c9d11d235702dff46bb74c80f7698
- https://www.debian.org/security/2023/dsa-5578
- https://bugs.ghostscript.com/show_bug.cgi?id=707264
- https://ghostscript.com/
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=dcdbc595c13c9d11d235702dff46bb74c80f7698
- https://www.debian.org/security/2023/dsa-5578
