Description
filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP1 | libmirage | 3.2.2-bp151.4.3.1 | openSUSE-SU-2019:2077-1 |
| SUSE Package Hub 15 | libmirage | 3.2.2-bp151.4.3.1 | openSUSE-SU-2019:2077-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | libmirage | 3.2.2-lp151.3.3.1 | openSUSE-SU-2019:2033-1 |
| openSUSE Leap 15.0 | libmirage | 3.2.2-lp150.2.3.1 | openSUSE-SU-2019:2040-1 |
Advisories 3
- openSUSE-SU-2019:2040-1 Security update for libmirage SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2077-1 Security update for libmirage SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2033-1 Security update for libmirage SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://sourceforge.net/p/cdemu/bugs/119/
- https://sourceforge.net/p/cdemu/code/ci/0e9292c9aa34bf545f43f7efe5f0b94faba94962/
- https://gist.github.com/andreafioraldi/baa79cd78131888d98d6ba680d5f514e
- openSUSE-SU-2019:2033 vendor-advisory
- openSUSE-SU-2019:2040 vendor-advisory
- openSUSE-SU-2019:2077 vendor-advisory