CVE-2024-29510

A flaw in Ghostscript has been identified where the uniprint device allows users to pass various string fragments as device options. These strings, particularly upWriteComponentCommands and upYMoveCommand, are treated as format strings for gp_fprintf and gs_snprintf. This lack of restriction permits arbitrary format strings with multiple specifiers, potentially leading to data leakage from the stack and memory corruption. In RHEL 9 or newer, an attacker could exploit this vulnerability to temporarily disable Ghostscript’s SAFER mode, which prevents Postscript code from executing commands or opening arbitrary files during the current invocation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Passing the -dSAFER safety argument on the command line prevents the issue by locking security-related variables after Ghostscript's initialization. In RHEL 9, -dSAFER is enabled by default, ensuring that insecure commands are rejected in a safer environment. The versions of Ghostscript in RHEL 7 and RHEL 8 have an older implementation of SAFER mode that is not enabled by default, but can be enabled by passing -dSAFER on the command line when invoking Ghostscript. This older SAFER mode implementation denies Postscript code the ability to change the output device, and therefore prevents malicious Postscript code from selecting the uniprint output device in order to exploit the format string vulnerabilities in its upWriteComponentCommands and upYMoveCommand parameters. On RHEL 7 and RHEL 8, we recommend always passing -dSAFER on the command line, and avoiding manually selecting the uniprint output device on the command line.