CVE-2024-47175highCWE-20

CVE-2024-47175: high-severity vulnerability in OpenPrinting libppd

libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer

Published · Updated

Follow this CVE+ Monitor libppd+ Monitor cups

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 8.6epss 64%
from disclosure to weaponsame day
Published on NVDSep 26
metasploitSep 26
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product (8 components)
Red Hat Enterprise Linux 7
workaround: See the security bulletin for a detailed mitigation procedure.
Fixed
22 products (528 components)
Red Hat Enterprise Linux AppStream (v. 9) · Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux BaseOS (v. 9) · Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux AppStream E4S (v.8.6) · and others 17
fix ↗
Not affected
2 products (11 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 10 · Red Hat OpenShift Container Platform 4
In short

A function in libppd fails to clean up printer attributes when converting IPP data to PPD format, allowing attackers to inject malicious content that could lead to code execution through the Foomatic printing system.

Technical detail

The ppdCreatePPDFromIPP2 function in libppd does not properly validate or sanitize IPP (Internet Printing Protocol) attributes before incorporating them into PPD buffer output. When combined with functions like cfGetPrinterAttributes5, user-controlled input can reach Foomatic rendering, enabling arbitrary code execution; this is a critical component in the CVE-2024-47176 exploit chain.

Summary generated and translated by AI from the official description.
CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected products
OpenPrinting · libppd
Related CVEs — OpenPrinting libppd

In the same product, most dangerous first.

CVE-2023-4504HIGHOpenPrinting CUPS/libppd Postscript Parsing Heap OverflowEPSS 0.6%