iccDEV Heap-Buffer-Overflow Vulnerability in CIccApplyCmmSearch Cost Function

A heap-buffer-overflow vulnerability has been identified in iccDEV versions prior to 2.3.1.6. The issue arises in the CIccApplyCmmSearch::costFunc() method, where malformed JSON configuration input to the iccApplySearch tool can trigger an out-of-bounds read of size 8. This vulnerability has been patched in version 2.3.1.6.

Impact

Exploitation of this vulnerability leads to a heap-buffer-overflow, which can commonly result in memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by using the iccApplySearch tool with a JSON configuration file that contains the 'pccFile' and 'weight' fields swapped. This malformed input will trigger the heap-buffer-overflow in the costFunc() method.

Remediation

Users can update to iccDEV version 2.3.1.6 or later to address this vulnerability.