libsoup Out-of-Bounds Read Vulnerability in Multipart Processing

A vulnerability allowing out-of-bounds read has been identified in libsoup's multipart processing subsystem. This issue arises in the 'soup_multipart_input_stream_read_headers()' function within 'soup-multipart-input-stream.c'. The vulnerability occurs because the function fails to properly validate the size of incoming multipart boundary strings. As a result, when a crafted HTTP response with a malformed or oversized boundary parameter is processed, the internal stream reader can read beyond the allocated buffer limits. This flaw can be exploited by a remote, unauthenticated attacker to cause a denial-of-service (DoS) by crashing the application or potentially reading fragments of unauthorized memory metadata.

Impact

Exploitation of this vulnerability leads to a segmentation fault, causing a crash of the application process. Additionally, it allows for reading adjacent memory contents, which could include sensitive information such as session tokens or credentials.

Reproduction

The vulnerability can be reproduced by sending a multipart HTTP response with an excessively long boundary string. This can be done using a malicious server that chunks the response to simulate the multipart transfer, effectively bypassing the normal boundary handling and triggering the out-of-bounds read.

Remediation

To mitigate this vulnerability, restrict network access to applications using libsoup for multipart processing from untrusted sources. Implement firewall rules to limit incoming connections to trusted clients and ensure that the service is not exposed to untrusted networks.