CVE-2021-45341: 
NixOS vulnerability analysis and mitigation

A buffer overflow vulnerability was discovered in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older versions. The vulnerability was disclosed in December 2021 and allows attackers to achieve Remote Code Execution using a crafted JWW document (LibreCAD Issue, NVD).

The vulnerability exists in the CDataMoji entity deserialization at LibreCAD/libraries/jwwlib/src/jwwdoc.h. A char buf[512] declared in CDataMoji::Serialize() is of fixed size 512, and some varieties of CDataMoji provide their own size without bounds checking being performed. This allows an attacker to overflow the buffer and overwrite other stack variables, including the return address (LibreCAD Issue).

An attacker can craft a JW-CAD input file to gain control over execution flow (EIP controlled directly), allowing them to run arbitrary code on the system running LibreCAD with the privileges of the current user (LibreCAD Issue).

The vulnerability can be exploited by creating a specially crafted JWW document that triggers a buffer overflow in the CDataMoji component. A proof of concept exploit has been demonstrated that causes an ACCESS_VIOLATION crash with eip=0x41414141 (AAAA) (LibreCAD Issue).

The vulnerability has been fixed in updated versions of LibreCAD. Various distributions have released security updates including Debian (2.1.3-1.3+deb11u1), Fedora, and Gentoo. The fix includes performing bounds checking in CDataMoji::Serialize() and refusing to load files that would overflow the buffer (Debian Security, Fedora Update).