Executive brief
LIEF is a library for parsing and analyzing binary files including Mach-O executables used in macOS. A flaw in the MachO parser can cause the application to crash (segmentation fault) when processing a specially crafted malformed Mach-O file, resulting in a denial of service for any tool or service using LIEF to parse untrusted binaries.
Technical details
The vulnerability is a denial-of-service crash (segmentation fault) in the LIEF::MachO::BinaryParser::init_and_parse function when parsing malformed Mach-O files. The root cause involves improper validation of corrupted symbol table entries (nlist) with invalid string indices, leading to out-of-bounds memory access. An attacker can craft a malicious MachO file with corrupted nlist structures that, when parsed by LIEF v0.12.1 and earlier, triggers a write to invalid memory. This is a network-reachable remote DoS if LIEF is used in a service that accepts file uploads or network input. A patch is available in commit fde2c48986739fabd2cf9b40b9af149a89c57850, fixed in version 0.12.2.
Affected products
- LIEF Project LIEF 0.8.0 through 0.12.1
Timeline
- 2022-10-04: disclosed
- 2022-10-06: patched: Version 0.12.2 released with fix