Cloudanix VulnDB

CVE-2022-2085

Medium · 5.5

CVSS

5.5

EPSS

1.4%

Published

Jun 16, 2022

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a widely used document and image processing tool can make programs crash when they try to handle certain unusually detailed image files.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Denial Of Service
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference triggered during buffer device allocation for images exceeding 64 bits per pixel, because mem_x_device lacks an init_device_procs definition, resulting in application crash.

Why it matters to the business

Denial of service against any workflow that processes untrusted PostScript, PDF, or image files with Ghostscript, causing processing jobs to fail and requiring restarts or workarounds.

How an attack unfolds

An attacker supplies a crafted file containing an image or device definition with bits-per-pixel greater than 64; Ghostscript's memory allocation path selects the incomplete mem_x_device prototype, dereferences a null function pointer, and terminates the process.

How to fix it

Upgrade Ghostscript to a version containing the fix for the mem_x_device initialization path; rebuild any downstream packages that statically link Ghostscript; monitor vendor advisories for Fedora and Artifex releases.

How to confirm the fix worked

Confirm Ghostscript version is newer than the vulnerable release; attempt to render a test file with bpp > 64 and verify the process completes without crashing; review build logs for the corrected device initialization code.

Typical attack path

  1. Craft a malicious PostScript/PDF/image payload with bpp > 64
  2. Deliver the file to a Ghostscript invocation via email attachment, web upload, print queue, or command line
  3. Ghostscript parses the device parameters and attempts buffer allocation using the undefined init_device_procs
  4. Null dereference occurs and the process crashes

How to detect it

Monitor process crash logs and core dumps for Ghostscript segfaults on high-bit-depth image handling; correlate with file-processing service logs that show abrupt termination after receiving PostScript or PDF input.

What your security team should do

  • Prioritize patching Ghostscript on all servers and workstations that accept untrusted documents
  • Restrict Ghostscript execution to trusted inputs or sandbox it until patches are applied
  • Add the CVE to vulnerability scanners and asset inventories for affected Fedora and Artifex deployments

The record

A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buffer device, it relies on an init_device_procs defined for the device that uses it as a prototype that depends upon the number of bits per pixel. For bpp > 64, mem_x_device is used and does not have an init_device_procs defined. This flaw allows an attacker to parse a large number of bits (more than 64 bits per pixel), which triggers a NULL pointer dereference flaw, causing an application to crash.

Affected packages

Ecosystem Package Introduced Fixed
Debian:12 ghostscript 0 9.56.0~dfsg-1
Debian:13 ghostscript 0 9.56.0~dfsg-1
Ubuntu:18.04:LTS ghostscript 0 9.26~dfsg+0-0ubuntu0.18.04.16
Ubuntu:18.04:LTS ghostscript 0 9.26~dfsg+0-0ubuntu0.18.04.17
Ubuntu:20.04:LTS ghostscript 0 9.50~dfsg-5ubuntu4.5
Ubuntu:20.04:LTS ghostscript 0 9.50~dfsg-5ubuntu4.6
Ubuntu:22.04:LTS ghostscript 0 9.55.0~dfsg1-0ubuntu5.1

Related vulnerabilities