libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer
48Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 8.6epss 64%
from disclosure to weapon0 days
Published on NVDSep 26
metasploitSep 26
exploitation probability
64%top 1% of all CVEs
observed exploitation
nono source reports it
In short
A function in libppd fails to clean up printer attributes when converting IPP data to PPD format, allowing attackers to inject malicious content that could lead to code execution through the Foomatic printing system.
Technical detail
The ppdCreatePPDFromIPP2 function in libppd does not properly validate or sanitize IPP (Internet Printing Protocol) attributes before incorporating them into PPD buffer output. When combined with functions like cfGetPrinterAttributes5, user-controlled input can reach Foomatic rendering, enabling arbitrary code execution; this is a critical component in the CVE-2024-47176 exploit chain.
Summary generated and translated by AI from the official description.
CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected products
OpenPrinting · libppdReferences
https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5https://github.com/OpenPrinting/libppd/commit/d681747ebf12602cb426725eb8ce2753211e2477https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6https://lists.debian.org/debian-lts-announce/2024/09/msg00047.htmlhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0016https://security.netapp.com/advisory/ntap-20241011-0001/https://www.cups.orghttps://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-Ihttp://www.openwall.com/lists/oss-security/2024/09/27/3