In September 2023, a new vulnerability, CVE-2023-43789, was discovered affecting libXpm, the X PixMap (XPM) image format processing library used by many Linux desktop programs. If you use Linux with a graphical interface, there’s a good chance you are running something that depends on libXpm.

This post explains how the bug works, what an attacker could do with it, and how you can see the actual vulnerable code. We also show details on how someone might exploit this issue and read memory they shouldn't be able to.

What is libXpm?

libXpm is a C library that reads and writes images in the XPM format. It is often used for handling small icons, button images, and themes in Linux desktop environments.

The Vulnerability

This vulnerability is about a "boundary condition." The bug happens when the code that reads an XPM image doesn't correctly check the limits of memory. That means if you give it a file with certain values, it tries to read past the end (or before the start) of some memory buffer. That memory could contain sensitive information like passwords, keys, or data from other running processes.

Affected Code Example

You can find the main fix in this commit on GitHub.

Here’s a simplified version of the buggy code

/* xpmParse.c */
char buffer[1024];
...
if (header_size < sizeof(buffer)) {
    memcpy(buffer, header, header_size);
    /* process buffer */
}

If header_size somehow gets bigger than what the code expects, memcpy might copy extra bytes. The library then processes buffer as if everything was fine. But if a crafted XPM file tricks the program into reading more bytes, the attacker can read data that sits next to buffer in memory.

To exploit this, an attacker would

1. Make a malicious XPM file – The file would contain headers with values set to overflow what libXpm expects.
2. Get the file opened by a target program – This could be by sending it as an email attachment, putting it in a theme, or having a user preview or open the file.
3. Read sensitive leaked memory – When libXpm tries to process the bad file, it could expose contents from neighboring memory, possibly including secrets.

Let’s build a proof-of-concept XPM file

/* A crafted XPM file */
static char * example[] = {
"10 10 150 1",       /* 10x10 px, *too* many colors (150 declared, not provided) */
"A c #FFFFFF",
"B c #000000",
/* ... fewer than expected color definitions, rest omitted ... */
};

If a program using a vulnerable libXpm tries to load example.xpm, it reads past the colors section, pulling in whatever is in memory — potentially data from elsewhere in the process.

Here's how you might trigger the bug with Python and Pillow (using a vulnerable libXpm)

from PIL import Image

try:
    img = Image.open('exploit.xpm')  # your crafted file here
    img.show()
except Exception as e:
    print("Error:", str(e))

If you watch the output or debug the process, you might see unexpected data being processed (this data can be from the process heap).

References and Further Reading

- freedesktop.org advisory
- NIST NVD entry
- GitHub libXpm commit with the fix
- Debian Security Advisory DSN-5486-1

How to Protect Yourself

1. Update libXpm – Make sure you are running a version with the official patch.

Conclusion

CVE-2023-43789 is a serious issue, but only for local threats or if your system opens XPM files from untrusted sources. Always keep your software up-to-date, and check image files before opening them if you aren’t sure where they came from.

If you work with C or maintain Linux systems, reviewing the patch and your dependencies is a must.

Stay safe!

*Exclusively prepared for your use. Reference and share, but always patch your systems first!*

Timeline

Published on: 10/12/2023 12:15:10 UTC
Last modified on: 11/07/2023 04:21:30 UTC