CVE-2024-36474
📋 TL;DR
An integer overflow vulnerability in libgsf's Compound Document parser allows arbitrary code execution when processing malicious files. This affects applications using libgsf to handle Microsoft Office documents or other Compound Document Binary File formats. Users and systems processing untrusted files with vulnerable libgsf versions are at risk.
💻 Affected Systems
- GNOME Structured File Library (libgsf)
📦 What is this software?
Libgsf by Gnome
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the application using libgsf, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) or limited code execution depending on exploit sophistication and mitigations like ASLR.
If Mitigated
Application crash with no code execution if modern exploit mitigations are effective.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious file. No public proof-of-concept has been disclosed as of the references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.14.53 and later
Vendor Advisory: https://gitlab.gnome.org/GNOME/libgsf/-/issues/34
Restart Required: Yes
Instructions:
1. Update libgsf to version 1.14.53 or later using your distribution's package manager. 2. For Debian/Ubuntu: sudo apt update && sudo apt upgrade libgsf-1-114. 3. For Fedora/RHEL: sudo dnf update libgsf. 4. Restart applications using libgsf.
🔧 Temporary Workarounds
Disable libgsf file parsing
linuxConfigure applications to avoid using libgsf for parsing Compound Document files, if possible.
Use application sandboxing
linuxRun applications that process untrusted files in sandboxed environments (e.g., Flatpak, Snap, Firejail).
🧯 If You Can't Patch
- Restrict file uploads and processing of untrusted Compound Document files (e.g., .doc, .xls) in vulnerable systems.
- Implement strict file type validation and block suspicious files at network boundaries or application level.
🔍 How to Verify
Check if Vulnerable:
Check libgsf version: dpkg -l libgsf-1-114 or rpm -q libgsf. If version is 1.14.52 or earlier, it is vulnerable.Check Version:
pkg-config --modversion libgsf-1.0Verify Fix Applied:
Confirm libgsf version is 1.14.53 or later using the version check command.📡 Detection & Monitoring
Log Indicators:
- Application crashes or abnormal terminations when opening document files
- Unexpected process spawns from document viewers
Network Indicators:
- Inbound transfers of suspicious document files to vulnerable systems
SIEM Query:
source="application_logs" event_type="crash" process_name IN ("evince", "libreoffice", "gnome-documents")