CVE-2024-33766

Executive Summary

CVE-2024-33766 is a denial-of-service vulnerability in lunasvg v2.3.9, a lightweight SVG rendering library. The flaw is a Floating Point Exception (FPE) triggered in the blend_transformed_tiled_argb.isra.0 function during the processing of specially crafted SVG files. An attacker can exploit this by providing a malicious SVG that causes an invalid floating-point operation (e.g., division by zero), leading to a crash of the application using the library. No public exploit code or proof-of-concept is available, and the vendor has not released a patch. The CVSS score is 0.0 due to incomplete NVD data, but the vulnerability is real and can be weaponized for local or remote denial-of-service attacks.

Supply Chain & Package Security

lunasvg is a C++ library distributed via GitHub and potentially included in Linux distributions or embedded systems. As an open-source component, it may be integrated into larger applications, making this a supply chain risk. Users should audit their dependencies for lunasvg v2.3.9 and consider replacing it with a patched fork or alternative library until an official fix is released.

CVSS Breakdown & Threat Level

The NVD has not assigned a CVSS score or vector. Based on the vulnerability type (FPE leading to DoS), a reasonable assessment is:

• Attack Vector: Network (if the library processes remote SVG files) or Local (if the attacker provides a file locally)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must open the malicious SVG)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Base Score: 6.5 (Medium)

Threat Level: Medium. The vulnerability is easy to trigger but requires user interaction and only results in a crash, not code execution.

Deep Dive & Mechanics

The FPE occurs in the blend_transformed_tiled_argb.isra.0 function, which is part of lunasvg's rendering pipeline for tiled images with transformations. The function performs arithmetic operations on floating-point numbers without proper validation. When an SVG file contains specific transformation parameters (e.g., scale factors of zero or extreme values), the function may attempt to divide by zero or produce an infinity, causing the program to crash.

The root cause is a lack of input validation on transformation matrix values. The library does not check for zero or near-zero values in the transformation parameters before using them in division operations.

Vulnerable vs. Patched Code

Vulnerable Code (v2.3.9): The exact vulnerable code is in the blend_transformed_tiled_argb function. A simplified representation:

void blend_transformed_tiled_argb(...) {
    float scale_x = ...; // from SVG transformation
    float scale_y = ...;
    // No check for zero
    float inv_scale_x = 1.0f / scale_x; // FPE if scale_x == 0
    float inv_scale_y = 1.0f / scale_y; // FPE if scale_y == 0
    ...
}

Patched Code (Hypothetical):

void blend_transformed_tiled_argb(...) {
    float scale_x = ...;
    float scale_y = ...;
    // Validate input
    if (fabs(scale_x) < 1e-10f || fabs(scale_y) < 1e-10f) {
        // Handle gracefully, e.g., skip or use identity
        return;
    }
    float inv_scale_x = 1.0f / scale_x;
    float inv_scale_y = 1.0f / scale_y;
    ...
}

No official patch exists. Users must apply this fix manually or use a fork.

Exploitation & Lab Setup

Red Team

No public exploit code exists. To reproduce the crash, create an SVG file with a transformation that causes division by zero:

<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <defs>
    <pattern id="p" width="10" height="10" patternUnits="userSpaceOnUse">
      <rect width="10" height="10" fill="red"/>
    </pattern>
  </defs>
  <rect width="100" height="100" fill="url(#p)" transform="scale(0,1)"/>
</svg>

Run lunasvg crash.svg to trigger the FPE.

Blue Team

• Monitor for crashes in applications using lunasvg.
• Use file integrity monitoring to detect malicious SVG files.
• Implement input validation on SVG files before processing.

Indicators of Compromise (IOCs)

• File Hashes: No specific hashes available.
• Network: No network indicators.
• Process: Application crash logs showing SIGFPE or Floating point exception in blend_transformed_tiled_argb.
• File: SVG files with transform="scale(0,...)" or similar zero-scale transformations.

Detection Engineering

YARA Rule

rule CVE_2024_33766_lunasvg_FPE {
    meta:
        description = "Detects SVG files that may trigger FPE in lunasvg v2.3.9"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-33766"
    strings:
        $scale_zero = /transform\s*=\s*["']scale\s*\(\s*0\s*,/ nocase
        $scale_zero2 = /transform\s*=\s*["']scale\s*\(\s*[0-9.]+\s*,\s*0\s*\)/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-33766 lunasvg FPE Detection
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects crashes from lunasvg FPE vulnerability
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: linux
detection:
    selection:
        EventID: 7  # Linux crash event
        Message|contains: 'SIGFPE'
        Image|endswith: 'lunasvg'
    condition: selection
falsepositives:
    - Legitimate SVG files with zero-scale transforms (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-33766 lunasvg FPE SVG Download"; flow:to_client; file.data; content:"transform"; content:"scale"; content:"0"; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Do not process untrusted SVG files with lunasvg v2.3.9.
2. Short-term: Apply the patch shown in the "Vulnerable vs. Patched Code" section to your local copy of lunasvg.
3. Long-term: Monitor the lunasvg repository for an official fix. Consider switching to a maintained fork or alternative SVG library (e.g., librsvg, nanosvg).
4. Detection: Deploy the YARA and Sigma rules to detect malicious SVG files and crashes.
5. Compensating Controls: Use a Web Application Firewall (WAF) to block SVG uploads if not needed, or sanitize SVG files before processing.

Valters IT