Cloudanix VulnDB

CVE-2024-36600

High · 8.4

CVSS

8.4

EPSS

0.4%

Published

Jun 14, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A common library used to read disc image files contains a flaw that lets attackers run their own programs if someone opens a specially crafted image file.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Full Compromise
Component
Library
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Buffer overflow in libcdio 2.2.0 when parsing malformed ISO 9660 directory structures allows an attacker-controlled memory write that leads to arbitrary code execution in the context of the calling process.

Why it matters to the business

Systems that ingest untrusted ISO images (media players, backup tools, forensic utilities) become vectors for local code execution; organizations must treat any untrusted disc image as a potential initial foothold.

How an attack unfolds

An attacker crafts a malformed ISO 9660 image that triggers an out-of-bounds write during directory record parsing; the victim opens the image with any application linked against the vulnerable library, and the overflow is used to redirect execution to attacker-supplied shellcode.

How to fix it

Upgrade libcdio to version 2.3.0 or later on all systems; rebuild and redeploy any statically linked applications; remove or isolate legacy packages that cannot be updated.

How to confirm the fix worked

Run 'cd-info --version' or equivalent library query to confirm 2.3.0 or newer; scan package managers and container images for references to libcdio <= 2.2.0; test with known-good and known-bad ISO samples in a sandbox.

Typical attack path

  1. Create or obtain a crafted ISO 9660 image containing oversized or malformed directory entries
  2. Deliver the image via download, USB, or shared storage
  3. Victim application linked to libcdio 2.2.0 opens or indexes the image
  4. Overflow occurs during parsing, enabling code execution or crash

How to detect it

Review application crash logs for segmentation faults or heap corruption when processing ISO files; correlate file-open events with subsequent unexpected process creation or network activity from media-handling binaries.

What your security team should do

  • Prioritize upgrade of libcdio across build pipelines and runtime environments within 30 days
  • Add libcdio version checks to SBOM and vulnerability scanning policies
  • Block or sandbox untrusted ISO handling until patches are applied
  • Monitor for new exploit PoCs given the local attack surface

The record

Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.

Affected packages

Ecosystem Package Introduced Fixed
Mageia:9 libcdio 0 2.1.0-4.1.mga9
Ubuntu:20.04:LTS libcdio 0 2.0.0-2ubuntu0.2
Ubuntu:22.04:LTS libcdio 0 2.1.0-3ubuntu0.2
Ubuntu:23.10 libcdio 0 2.1.0-4ubuntu0.2
Ubuntu:24.04:LTS libcdio 0 2.1.0-4.1ubuntu1.2
Ubuntu:Pro:14.04:LTS libcdio 0 0.83-4.1ubuntu1+esm3
Ubuntu:Pro:16.04:LTS libcdio 0 0.83-4.2ubuntu1+esm3
Ubuntu:Pro:18.04:LTS libcdio 0 1.0.0-2ubuntu2+esm2

Related vulnerabilities