The GitHub Security Lab recently disclosed a memory corruption vulnerability in the libcue library, which affects GNOME Linux systems [5]. This vulnerability allows for remote code execution and has a high severity level.
Description
The vulnerability, identified as CVE-2023-43641 [1] [2], has a CVSS score of 8.8 [5]. It arises from an out-of-bounds array access in the tracksetindex function of libcue [2]. Versions 2.2.1 and earlier are impacted. Exploiting this vulnerability involves tricking a user into downloading a malicious .cue file while using the GNOME desktop environment. The file is saved in the user’s Downloads folder and is automatically scanned by tracker-miners [4] [6], an application that indexes files in users’ home directories [3]. Since the file has a .cue extension [4] [6], tracker-miners use libcue to parse it [4] [6], which allows the exploit to gain code execution [4] [6]. This vulnerability has been described as a one-click remote code execution. Users are advised to exercise caution and avoid clicking on suspicious links to prevent exploitation [3]. Technical details have been withheld to allow users time to install updates [2].
Conclusion
The disclosure of this vulnerability highlights the importance of promptly installing updates to mitigate the risk of remote code execution. It is worth noting that this disclosure comes shortly after GitHub revealed details about another remote code execution vulnerability in the Google Chrome V8 JavaScript engine. The severity level of the libcue library vulnerability is considered medium according to CVSS2 and high according to CVSS:3.0. This serves as a reminder for users to remain vigilant and stay updated on security vulnerabilities in order to protect their systems.
References
[1] https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/
[2] https://thehackernews.com/2023/10/libcue-library-flaw-opens-gnome-linux.html
[3] https://www.helpnetsecurity.com/2023/10/10/cve-2023-43641/
[4] https://nvd.nist.gov/vuln/detail/CVE-2023-43641
[5] https://allinfosecnews.com/item/a-flaw-in-libcue-library-impacts-gnome-linux-systems-2023-10-10/
[6] https://www.tenable.com/cve/CVE-2023-43641
