CVE-2024-21795
📋 TL;DR
A heap-based buffer overflow vulnerability in libbiosig's .egi file parser allows arbitrary code execution when processing malicious files. This affects systems using libbiosig 2.5.0 or the master branch commit ab0ee111 for biomedical signal processing. Attackers can achieve remote code execution by tricking users or automated systems into opening specially crafted .egi files.
💻 Affected Systems
- The Biosig Project libbiosig
📦 What is this software?
Fedora by Fedoraproject
Libbiosig by Libbiosig Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the application processing the .egi file, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Remote code execution on systems that automatically process .egi files or where users open untrusted .egi files, leading to malware installation or data exfiltration.
If Mitigated
Denial of service or application crash if exploit fails, with limited impact if proper sandboxing and privilege separation are implemented.
🎯 Exploit Status
Exploitation requires delivering a malicious .egi file to the target system, which could be achieved through phishing, compromised websites, or automated processing pipelines.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check upstream repository for fixes after commit ab0ee111
Vendor Advisory: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIRLGNQM33KAWVWP5RPMAPHWNP3IY5YW/
Restart Required: Yes
Instructions:
1. Check current libbiosig version
2. Update to patched version from official repository
3. Rebuild applications using libbiosig
4. Restart affected services
🔧 Temporary Workarounds
Disable .egi file processing
allTemporarily disable or block .egi file parsing in applications using libbiosig
# Configure applications to reject .egi files or use alternative formats
File type restrictions
linuxImplement file type filtering to block .egi files at network boundaries
# Example using iptables: iptables -A INPUT -m string --string ".egi" --algo bm -j DROP
🧯 If You Can't Patch
- Implement strict file upload controls and validation for .egi files
- Run libbiosig applications with minimal privileges and in isolated containers
🔍 How to Verify
Check if Vulnerable:
Check libbiosig version: biosig-tools --version or examine library filesCheck Version:
biosig-tools --version 2>&1 | grep -i version || strings /usr/lib*/libbiosig* | grep -i versionVerify Fix Applied:
Verify updated version is installed and test with known safe .egi files📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing .egi files
- Unusual process spawning from libbiosig applications
- Failed file parsing attempts
Network Indicators:
- Inbound .egi file transfers to vulnerable systems
- Outbound connections from libbiosig processes to suspicious IPs
SIEM Query:
source="application_logs" AND ("libbiosig" OR ".egi") AND ("crash" OR "buffer overflow" OR "segmentation fault")🔗 References
- https://talosintelligence.com/vulnerability_reports/TALOS-2024-1920
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIRLGNQM33KAWVWP5RPMAPHWNP3IY5YW/
- https://talosintelligence.com/vulnerability_reports/TALOS-2024-1920
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1920
