Junglewise Threat Intelligence

CVE-2015-8972: GNU Chess stack buffer overflow in ValidateMove function

CVE-2015-8972 · Severity: critical · CVSS 9.8 · Published 2017-01-23

Vendors: Gnu.

Executive brief

GNU Chess is a popular open-source chess engine used for playing and analyzing chess games. A security vulnerability in the way it handles move inputs allows an attacker to crash the application or potentially take control of the system. This is particularly risky if the engine is used as a backend for a web-based chess service or other networked applications.

Technical details

A stack-based buffer overflow exists in the ValidateMove function within frontend/move.cc of GNU Chess (gnuchess). The vulnerability is caused by insufficient bounds checking when copying user-supplied move strings into a fixed-size buffer (MAXSTR, typically 128 bytes). While gnuchess is often used locally, the vulnerability can be exploited remotely if the engine is running in Universal Chess Interface (UCI) mode as a backend for a network-accessible service. An attacker providing a move string longer than the buffer can overwrite the stack, leading to a denial of service (crash) or arbitrary code execution. The issue was addressed in version 6.2.4 by adding a length check and null-terminating long inputs.

Affected products

  • GNU GNU Chess before 6.2.4

Timeline

  • 2015-10-29: disclosed: Initial bug report by Antti Karjalainen on the bug-gnu-chess mailing list
  • 2016-09-20: patched: Fix committed to Savannah SVN repository
  • 2016-11-14: advisory: CVE-2015-8972 assigned via oss-security mailing list
  • 2017-01-23: other: NVD publication date

References