The Sleuth Kit APFS Filesystem Keybag Parser Out-of-Bounds Read Vulnerability

A vulnerability allowing out-of-bounds read has been identified in The Sleuth Kit versions through 4.14.0. This issue resides in the APFS filesystem keybag parser, where the 'wrapped_key_parser' class improperly handles length fields controlled by attackers, leading to unauthorized heap reads beyond the allocated buffer. An attacker could create a malicious APFS disk image that, when processed by any Sleuth Kit tool that analyzes APFS volumes, could cause information disclosure or a crash.

Impact

Exploitation of this vulnerability can result in unauthorized information disclosure or a crash of the application.

Remediation

Users can upgrade to The Sleuth Kit version 4.14.1 or later to address this vulnerability.