CVE-2024-29509: 
Ghostscript vulnerability analysis and mitigation

CVE-2024-29509 affects Artifex Ghostscript versions before 10.03.0, discovered and disclosed in July 2024. The vulnerability involves a heap-based buffer overflow condition in the PDFPassword parameter handling functionality, specifically when processing passwords containing null bytes in the middle of the string (NVD, OpenWall).

The vulnerability occurs in the runpdf command's PDF interpreter when handling the PDFPassword parameter. During the decryption process in check_password_R5 function within pdf_sec.c, a buffer is allocated based on the string length of the password field, but the subsequent memcpy operation copies the full length of the PS-supplied object into this buffer. This mismatch leads to a heap buffer overflow when a PDFPassword value contains a null byte in the middle, as PS-strings are not null-terminated (OpenWall). The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (High) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The vulnerability can lead to heap buffer overflow conditions, potentially resulting in arbitrary code execution, system crashes, or memory corruption. The high CVSS score indicates significant potential impact on the confidentiality, integrity, and availability of affected systems (NVD).

The vulnerability can be triggered by providing a specially crafted PDFPassword parameter containing a null byte in the middle. For example, using the PostScript command /PDFPassword (foo\000bar) def will result in a memcpy of 7 bytes into a buffer of size 3, causing the overflow (OpenWall).

The vulnerability has been fixed in Ghostscript version 10.03.0 released on March 6, 2024. Users are advised to upgrade to this version or later to mitigate the vulnerability. The fix was implemented through commit 917b3a71fb20748965254631199ad98210d6c2fb in the Ghostscript repository (Debian Security).