LibVNCClient Tight Gradient Heap Overflow Vulnerability Analysis

Vulnerability Overview LibVNCClient Tight Gradient Decoder Allows Heap/Stack Out-of-Bounds Write Triggered by Malicious Server Vulnerability Description: The Tight codec decoder in LibVNCClient uses a fixed-size 2048-pixel buffer for Gradient filtering but fails to enforce the constraint that the Tight rectangle width must not exceed 2048 pixels. A malicious VNC server can create a FramebufferUpdate rectangle encoded with Tight encoding. When the LibVNCClient client connects, it processes the server-controlled rectangle width and writes outside the fixed-size Gradient buffer. Impact: - Client-side memory corruption triggered by malicious servers - Out-of-bounds writes to heap/stack objects - Overwriting of data pointers and callback function pointers - Limited local read/write primitives demonstrated in lab environments - Potential for RCE-like impacts, but no reliable full RCE exploit has been achieved Scope Affected Versions: - Current main branch: - Possible versions: 0.9.15 (if the code exists) Fixed Versions: Unknown Remediation Recommended Fixes: - Reject Tight rectangles using Gradient filtering with widths exceeding the fixed row buffer. - Alternatively, replace the fixed 2048-pixel Scratch buffer with dynamically allocated buffers, which are checked against security limits. - At a minimum, the Gradient filter should enforce logic equivalent to the following: POC Code Evidence Heap/Stack Object Out-of-Bounds Writes: - Using a Tight Gradient rectangle with a width of 5000 pixels: - ASAN Report: Stack/Local Array Out-of-Bounds Writes: - Using a Tight Gradient rectangle with a width of 3000 pixels: - ASAN/UBSAN Report: Additional Exploitability Notes 16bpp Internal Object Overwrite Reaching Fields: - Performed using a local probe with , causing to execute: - Subsequent row loops do not execute, isolating the internal object overwrite. - At width 2056, fields are overwritten after : - At width 2072, the same internal overwrite reaches callback pointers, causing NULL dereference: - Evidence: 32bpp Limited Write Primitive: - In the 32bpp non-zero path, stack OOB can corrupt the stack local pointer: - In the local sentinel mapping probe, is corrupted to: - And final writes to this address are verified: - Evidence: 32bpp Limited Read-Write Data Flow: - The adjacent stack local pointer is also calculated, so the next pixel read originates from the process memory source. The sentinel value appears at the final write destination after : - Observation: ``` src=base=0x75590d4a8888 p0=0x75590d4a8941 p1=0x75590d4a8944 off=0xff=0x200c before write_ptr=0x4100410041 nonzero_tail_0x55=0x1 tail=0x0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Goal Reached Thanks to every supporter — we hit 100%!

LibVNCClient Tight Gradient Heap Overflow Vulnerability Analysis

More from this source