ghidra: Improper Handling of Highly Compressed Theme Archive Causes Denial of Service

Summary

A maliciously crafted theme archive can cause uncontrolled resource consumption during theme import because the importer processes attacker-controlled ZIP entries without enforcing an effective limit on their decompressed size. A relatively small malicious archive can therefore cause the importer to consume a substantially larger amount of disk space, potentially exhausting the available space on the host filesystem. Once the filesystem is exhausted, subsequent imports and other applications that require disk writes may fail, resulting in a denial-of-service condition and loss of system availability.

Details

readZipTheme() is responsible for extracting theme data and icons from a theme ZIP archive. In particular, icons are extracted from the image/ subdirectory of the archive to /home/USERNAME/.config/ghidra/Ghidra*/images on the host filesystem. If an archive contains an icon file larger than the available disk space on the host partition, the extraction can exhaust all available disk space, preventing further imports. Additionally, applications on the affected system that depend on disk I/O may become unable to function properly.

Impact

The vulnerability allows an attacker to cause uncontrolled resource consumption by supplying a highly compressed ZIP entry with a very large decompressed size.

This can result in:

1. excessive disk-space consumption;
2. excessive CPU and I/O usage during decompression;
3. failure of subsequent import operations;
4. inability to perform other operations when system resources are exhausted; and potentially denial of service if sufficient resources are consumed.

Note: Once all available disk space is exhausted, other system-wide applications that depend on disk I/O may fail or become unable to perform write operations.

Subsequent System Impact

[yuvraj@archlinux ~]$ df Filesystem 1K-blocks Used Available Use% Mounted on dev 1847472 0 1847472 0% /dev run 1942264 1768 1940496 1% /run efivarfs 384 314 66 83% /sys/firmware/efi/efivars /dev/sda2 121453232 115237348 256 100% // DISK FULLY CONSUMED / tmpfs 1942264 3120 1939144 1% /dev/shm none 1024 0 1024 0% /run/credentials/systemd-journald.service tmpfs 1942268 4 1942264 1% /tmp /dev/sda1 1046508 175652 870856 17% /boot tmpfs 388452 52 388400 1% /run/user/1000