CVE-2023-31979

What it actually does

Global buffer overflow in catdoc process_file function allows out-of-bounds memory writes when parsing specially crafted input files, enabling local code execution or denial of service.

Why it matters to the business

Attackers with local access can compromise systems processing untrusted documents via catdoc, potentially leading to container escapes or lateral movement in Cilium-managed environments; low EPSS and long public availability reduce immediate external risk but exploit code existence raises urgency for patching.

How an attack unfolds

An attacker crafts a malicious document that triggers the overflow in catdoc's reader.c when the process_file function is invoked, overwriting memory to execute arbitrary code under the privileges of the calling process; public exploit code facilitates local testing and adaptation.

How to fix it

Upgrade affected Chainguard packages to the fixed versions: cilium-fips-1.14 to 1.14.8-r0 and equivalent updates for cilium-fips-1.14-container-init, cilium-fips-1.14-container-init-compat, cilium-fips-1.14-host-utils, cilium-fips-1.14-hubble-relay, cilium-fips-1.14-iptables, and cilium-fips-1.14-operator-generic; remove or isolate older catdoc v0.95 binaries.

How to confirm the fix worked

Verify package versions match or exceed 1.14.8-r0 across listed Cilium components; test catdoc against known trigger files in a lab to confirm absence of overflow behavior; scan container images for vulnerable catdoc binaries.

Typical attack path

1. Obtain or create a malicious document file designed to overflow the global buffer in process_file
2. Place the file in a location accessible to a process using catdoc (e.g., document conversion workflow)
3. Trigger catdoc execution on the file via local user, script, or automated pipeline
4. Achieve memory corruption leading to code execution or crash

How to detect it

Review process execution logs and command-line arguments for catdoc invocations on untrusted files; inspect core dumps or crash reports indicating buffer issues; correlate with file creation events preceding catdoc runs.

What your security team should do

• Immediately upgrade all listed Chainguard cilium-fips packages to 1.14.8-r0 or newer
• Audit environments for any remaining use of catdoc v0.95 in document processing pipelines
• Restrict catdoc execution to trusted input sources and run under least privilege
• Monitor for new public exploits given available maturity status