CVE-2024-25004: 
NixOS vulnerability analysis and mitigation

KiTTY versions 0.76.1.13 and before contain a stack-based buffer overflow vulnerability (CVE-2024-25004) in the username input functionality. The vulnerability was introduced in the original release in May 2021 (commit 4f79b1e) and affects all versions up to 0.76.1.13 in their default configuration (DEFCESCO Blog).

The vulnerability exists in kitty.c at line 2600 due to insufficient bounds checking and input sanitization when processing the username input. When KiTTY encounters the ANSI escape sequence \033]0;__dt, it interprets it as an instruction to create a duplicate terminal session. The vulnerable code uses strcpy() without proper bounds checking, allowing an attacker to overwrite adjacent memory (DEFCESCO Blog). The vulnerability has been assigned a CVSS v3.1 base score of 7.8 HIGH (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) (NVD).

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code in the context of the user running the application. By default, KiTTY operates in the standard user permission group, making this vulnerability particularly concerning for all Windows operating systems including Windows 11, 10, 8, 7, and XP (DEFCESCO Blog).