Graphviz Buffer Overflow Code Execution

Risk: High
Local: Yes
Remote: No
CWE: CWE-119

CVSS Base Score: 8.5/10
Impact Subscore: 10/10
Exploitability Subscore: 6.8/10
Exploit range: Remote
Attack complexity: Medium
Authentication: Single time
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

The graphviz team has just released a patch to a critical security issue I reported to them. The following is the advisory (also available at Background ========== Graphviz is an open-source multi-platform graph visualization software. It takes a description of graphs in a simple text format (DOT language), and makes diagrams out of it in several useful formats (including SVG). Description =========== A vulnerability exists in Graphviz's parsing engine which makes it possible to overflow a globally allocated array and corrupt memory by doing so. parser.y (Graphviz 2.20.2): 34: static Agraph_t *Gstack[32]; 35: static int GSP; 45: static void push_subg(Agraph_t *g) 46: { 47: G = Gstack[GSP++] = g; 48: } As it can be seen, no bounds check is performed by the push_svg procedure, allowing one to overflow Gstack by pushing more than 32 (Agraph_t *) elements. Impact/Severity =============== A malicious user can achieve an arbitrary code execution by creating a specially crafted DOT file and convince the victim to render it using Graphviz. Affected versions ================= Graphviz 2.20.2 is affected by this vulnerability. Older version are probably affected as well. Workaround =========== Version 2.20.3 has been released in order to address this issue. A bounds check has been added in order to avoid an overflow. parser.y (Graphviz 2.20.3): 34: #define GSTACK_SIZE 64 35: static Agraph_t *Gstack[GSTACK_SIZE]; 36: static int GSP; 45: 46: static void push_subg(Agraph_t *g) 47: { 48: if (GSP >= GSTACK_SIZE) { 49: agerr (AGERR, "Gstack overflow in graph parser\n"); exit(1); 50: } 51: G = Gstack[GSP++] = g; 52: } Acknowledgements ================ I would like to thank the Graphviz team (Stephen C. North, John Ellson, Emden R. Gansner and others) for their quick responses and fix (it took them only a day since my disclosure to release a patch!).


Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018,


Back to Top