CVE-2014-9273: Buffer Overflow
It was reported that hivex [1], a library that can read and write hive files (undocumented binary files that Windows uses to store the Windows Registry on disk), did not properly handle small-sized hive files. An attacker able to supply a hive file of a small size to an application using the hivex library could use this flaw to read, and possibly write, up to 4095 bytes beyond the end of the allocated buffer, potentially resulting in arbitrary code execution with the with the privileges of the user running that application.
This issue has been fixed in upstream version 3.11 of hivex. Upstream patches are available at:
https://github.com/libguestfs/hivex/commit/357f26fa64fd1d9ccac2331fe174a8ee9c607adb https://github.com/libguestfs/hivex/commit/4bbdf555f88baeae0fa804a369a81a83908bd705
Reproducer: https://bugzilla.redhat.com/showbug.cgi?id=1158992#c0
[1] https://www.redhat.com/archives/libguestfs/2014-October/msg00235.html
Acknowledgements:
Red Hat would like to thank Mahmoud Al-Qudsi of NeoSmart Technologies for reporting this issue.
Other sources
lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9273?
CVE-2014-9273 has a medium severity rating due to its potential for exploitation via specially crafted hive files.
How do I fix CVE-2014-9273?
To fix CVE-2014-9273, upgrade the hivex library to version 1.3.11 or later.
Which software is affected by CVE-2014-9273?
CVE-2014-9273 affects various versions of the hivex library across Red Hat and openSUSE distributions.
What types of attacks can CVE-2014-9273 enable?
CVE-2014-9273 can enable attackers to cause denial of service or potentially execute arbitrary code by providing malformed hive files.
Is there a workaround for CVE-2014-9273?
There is no official workaround for CVE-2014-9273; updating to a safe version is the recommended approach.