Quill Unbounded Memory Allocation Vulnerability in Mach-O Binary Parsing

A memory exhaustion vulnerability has been identified in Quill versions prior to 0.7.1. This issue arises from unbounded memory allocation when the application parses Mach-O binaries. The vulnerability can be exploited by supplying a crafted Mach-O file with large values in specific size and count fields, leading Quill to allocate excessive memory. This flaw is likely to be exploited in environments that accept external binaries for signing, such as CI/CD pipelines or shared signing services. The excessive memory allocation can cause denial-of-service conditions, potentially crashing the host process.

Impact

Exploitation of this vulnerability leads to memory exhaustion and denial-of-service conditions, causing the host process to crash.

Remediation

Users can upgrade to Quill version 0.7.1 to address this vulnerability.