CVE-2022-35110

What it actually does

The vulnerability is a memory leak in the memory management functions in lib/mem.c, which fails to release allocated memory under certain conditions, leading to gradual depletion of system resources.

Why it matters to the business

Prolonged use of the affected tool can lead to increased memory consumption, potentially causing application crashes or system instability in environments where SWFTools is used for processing files.

How an attack unfolds

An attacker with local access can craft a malicious input file that triggers repeated allocations without corresponding frees when processed by SWFTools, leading to memory exhaustion.

How to fix it

Update to a version of SWFTools that addresses the memory leak in lib/mem.c; if no fixed version is available, consider alternative tools or sandbox the execution to limit resource usage.

How to confirm the fix worked

Review source code changes in mem.c for proper memory deallocation calls; test with memory profiling tools like Valgrind to ensure no leaks on typical inputs.

Typical attack path

1. Obtain local access to a system with SWFTools installed
2. Prepare a specially crafted input file designed to trigger the memory leak
3. Execute the vulnerable SWFTools command with the malicious file
4. Monitor system memory usage until exhaustion occurs, causing denial of service

How to detect it

Check system logs for unusual memory usage patterns or OOM killer events associated with SWFTools processes; look for repeated executions with specific file types.

What your security team should do

• Assess usage of SWFTools in the environment and limit to trusted inputs
• Monitor for updates from the project maintainers
• Implement resource limits on processes using the tool