Cloudanix VulnDB

CVE-2022-35111

Medium · 5.5

CVSS

5.5

EPSS

0.3%

Published

Aug 16, 2022

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A problem in SWFTools can make the program crash when it tries to handle certain files, which may interrupt work that depends on those tools.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Stack-based buffer overflow in StackDepotNode::hash during stack trace processing, enabling local memory corruption or denial of service.

Why it matters to the business

Local users or automated workflows processing untrusted SWF files may experience application crashes, interrupting document conversion or analysis tasks with low likelihood of remote exploitation.

How an attack unfolds

An attacker crafts a malicious SWF file that, when opened by an affected SWFTools utility, triggers the stack overflow in the sanitizer stack depot code; because the issue has public exploit code available and requires only local file handling, it can be triggered by tricking a user into processing the file on a vulnerable system.

How to fix it

Upgrade SWFTools to the latest available build that resolves the stack depot overflow; if no patched release exists, replace affected tools with maintained alternatives and restrict processing of untrusted SWF content.

How to confirm the fix worked

Rebuild or run the SWFTools utilities under AddressSanitizer or similar instrumentation against the previously crashing test cases; confirm absence of the stack depot hash overflow and verify successful processing of the same inputs without crash.

Typical attack path

  1. Generate or obtain a specially crafted SWF file designed to overflow the stack depot hash function
  2. Deliver the file to a target via email, download, or shared storage
  3. Induce the victim to open the file with an affected SWFTools binary
  4. Trigger the overflow resulting in process crash or potential memory corruption

How to detect it

Review local execution logs or crash reports for SWFTools binaries that reference sanitizer_stackdepot.cpp or StackDepotNode::hash; look for segmentation faults or stack overflow signals during SWF file processing.

What your security team should do

  • Inventory all deployments of SWFTools and flag any instances still at commit 772e55a2 or earlier
  • Block or sandbox SWFTools usage on untrusted inputs until patched builds are deployed
  • Monitor for new upstream releases and apply them promptly given the public exploit availability

The record

SWFTools commit 772e55a2 was discovered to contain a stack overflow via __sanitizer::StackDepotNode::hash(__sanitizer::StackTrace const&) at /sanitizer_common/sanitizer_stackdepot.cpp.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS swftools 0 No fix
Ubuntu:18.04:LTS swftools 0 No fix
Ubuntu:Pro:16.04:LTS swftools 0 No fix
Ubuntu:Pro:18.04:LTS swftools 0 No fix

Related vulnerabilities