CVE-2024-23313: 
Linux Debian vulnerability analysis and mitigation

An integer underflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). The vulnerability was discovered by Lilith of Cisco Talos and was assigned CVE-2024-23313. A specially crafted .famos file can lead to an out-of-bounds write which in turn can lead to arbitrary code execution (Talos Report).

The vulnerability is caused by an integer underflow in the sopen_FAMOS_read functionality, which can be triggered when processing specially crafted .famos files. The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue is classified as CWE-191 (Integer Underflow) and can lead to out-of-bounds write conditions (NVD, Talos Report).

The vulnerability allows an attacker to achieve arbitrary code execution by providing a malicious file. The critical CVSS score of 9.8 indicates severe potential impact with complete compromise of system confidentiality, integrity, and availability (Talos Report).

The vulnerability has been addressed in biosig4c++ version 2.6.0, where FAMOS support is disabled by default and can only be enabled by setting BIOSIG_FAMOS_TRUST_INPUT=1. Users are advised to upgrade to this version to mitigate the vulnerability (Fedora Update).