CVE-2024-37535: 
CBL Mariner vulnerability analysis and mitigation

GNOME VTE before version 0.76.3 contains a vulnerability that allows an attacker to cause a denial of service through memory consumption. The vulnerability is triggered by a window resize escape sequence and is related to a similar issue (CVE-2000-0476) that affected XTerm in 2000 (NVD, OSS Security).

The vulnerability exists in the handling of ANSI escape sequences for terminal window resizing. Specifically, the sequences '\e[4;;t' and '\e[8;;t' can be exploited, where the middle values represent height and width. By providing large values (such as 65535) for both dimensions, an attacker can trigger excessive memory consumption that may freeze the entire system (OSS Security, OSS Security Reply).

When successfully exploited, this vulnerability can lead to a complete system freeze due to uncontrolled memory consumption. The attack affects the local system running GNOME VTE, potentially making it unresponsive and requiring a system restart (OSS Security).

The vulnerability can be exploited locally by executing specific terminal commands. A proof of concept exists and involves opening gnome-terminal and executing printf commands with specific escape sequences. Two known variants of the exploit use '\e[4;65535;65535t' and '\e[8;65535;65535t' (OSS Security Reply).

The vulnerability has been fixed in GNOME VTE version 0.76.3. Users are advised to upgrade to this version or later to mitigate the issue. Multiple Linux distributions have released security updates, including Ubuntu which has provided fixes for various releases including 24.04 LTS, 23.10, 22.04 LTS, and 20.04 LTS (Ubuntu Security).