CVE-2020-15900: Ghostscript Privilege Escalation Flaw

CVE-2020-15900 Overview

A critical memory corruption vulnerability was discovered in Artifex Ghostscript versions 9.50 and 9.52. The flaw exists in the rsearch PostScript operator implementation within psi/zstring.c, where an incorrect size calculation can cause an integer underflow. When calculating the 'post' size, the result could be too large and underflow to the maximum uint32_t value, leading to memory corruption. This vulnerability can be exploited through maliciously crafted PostScript files to override file access controls.

Critical Impact

This integer underflow vulnerability allows attackers to corrupt memory and potentially override file access controls through specially crafted PostScript documents, enabling remote code execution without authentication.

Affected Products

• Artifex Ghostscript 9.50
• Artifex Ghostscript 9.52
• Canonical Ubuntu Linux 20.04 LTS
• openSUSE Leap 15.1
• openSUSE Leap 15.2

Discovery Timeline

• 2020-07-28 - CVE-2020-15900 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-15900

Vulnerability Analysis

The vulnerability resides in the PostScript interpreter's handling of the rsearch operator in the psi/zstring.c source file. The root issue is an integer underflow condition that occurs during size calculations for string operations. When the rsearch operator processes specially crafted input, the calculation for the 'post' size can produce a value that exceeds expected bounds. This miscalculation causes the size to underflow to the maximum uint32_t value (4,294,967,295), resulting in severe memory corruption.

The impact is significant because Ghostscript is widely deployed as a document processing engine, used by printing systems, document conversion tools, and PDF viewers. An attacker can exploit this vulnerability by convincing a user or automated system to process a malicious PostScript or PDF file. Successful exploitation could lead to arbitrary code execution with the privileges of the Ghostscript process, potentially compromising the entire system.

Root Cause

The vulnerability stems from improper integer arithmetic in the rsearch function within psi/zstring.c. The original code used r_set_size() for size assignments without proper bounds checking. The size calculation for the 'post' portion of the search result could produce a negative value when specific string patterns were matched, which when cast to an unsigned integer would wrap around to an extremely large value. This is classified as CWE-191 (Integer Underflow).

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction beyond file processing. An attacker can deliver a malicious PostScript file through various channels:

1. Email attachments containing crafted PS or PDF files
2. Web-based document preview systems
3. Print servers processing untrusted documents
4. Automated document conversion pipelines

The malicious PostScript file would contain a non-standard operator sequence designed to trigger the integer underflow in the rsearch calculation, corrupting memory and potentially allowing arbitrary code execution.

// Security patch from psi/zstring.c
// Source: https://github.com/ArtifexSoftware/ghostpdl/commit/5d499272b95a6b890a1397e11d20937de000d31b

    return 0;
found:
    op->tas.type_attrs = op1->tas.type_attrs;
-    op->value.bytes = ptr;
-    r_set_size(op, size);
+    op->value.bytes = ptr;				/* match */
+    op->tas.rsize = size;				/* match */
    push(2);
-    op[-1] = *op1;
-    r_set_size(op - 1, ptr - op[-1].value.bytes);
-    op1->value.bytes = ptr + size;
-    r_set_size(op1, count + (!forward ? (size - 1) : 0));
+    op[-1] = *op1;					/* pre */
+    op[-3].value.bytes = ptr + size;			/* post */
+    if (forward) {
+        op[-1].tas.rsize = ptr - op[-1].value.bytes;	/* pre */
+        op[-3].tas.rsize = count;			/* post */
+    } else {
+        op[-1].tas.rsize = count;			/* pre */
+        op[-3].tas.rsize -= count + size;		/* post */
+    }
    make_true(op);
    return 0;
}

The patch replaces the vulnerable r_set_size() calls with direct assignments to tas.rsize and introduces conditional logic to handle forward and reverse search directions separately, preventing the integer underflow condition.

Detection Methods for CVE-2020-15900

Indicators of Compromise

• Unexpected Ghostscript process crashes or segmentation faults during document processing
• Anomalous memory allocation patterns in Ghostscript processes
• PostScript files containing unusual rsearch operator sequences with large string parameters
• Suspicious PDF or PS files from untrusted sources triggering document conversion failures

Detection Strategies

• Monitor for Ghostscript process crashes with memory corruption signatures in system logs
• Implement file integrity monitoring for systems running vulnerable Ghostscript versions
• Deploy network-based detection rules to identify malicious PostScript content patterns
• Review process execution logs for unexpected child processes spawned by Ghostscript

Monitoring Recommendations

• Enable verbose logging for document processing pipelines to capture Ghostscript errors
• Implement endpoint detection monitoring for memory corruption exploitation techniques
• Configure SIEM alerts for repeated Ghostscript failures from specific sources
• Monitor system call patterns from Ghostscript processes for anomalous behavior

How to Mitigate CVE-2020-15900

Immediate Actions Required

• Update Artifex Ghostscript to version 9.53 or later immediately
• Apply available security patches from distribution repositories (Ubuntu USN-4445-1, Gentoo GLSA-202008-20, openSUSE security advisories)
• Restrict Ghostscript from processing untrusted documents until patched
• Consider sandboxing Ghostscript processes to limit exploitation impact

Patch Information

The vulnerability was fixed in Ghostscript commit 5d499272b95a6b890a1397e11d20937de000d31b. Organizations should update to Ghostscript version 9.53 or later, which includes this security fix. Distribution-specific patches are available:

• Artifex Security Advisory
• Ubuntu Security Notice USN-4445-1
• Gentoo GLSA Advisory
• GitHub Security Commit

Workarounds

• Configure Ghostscript with -dSAFER mode to restrict file operations until patching is possible
• Implement input validation to block PostScript files from untrusted sources
• Use application sandboxing (containers, AppArmor, SELinux) to isolate Ghostscript processes
• Disable automatic document preview functionality that relies on Ghostscript

# Configuration example - Running Ghostscript in safer mode
gs -dSAFER -dBATCH -dNOPAUSE -sDEVICE=pdfwrite -sOutputFile=output.pdf input.ps

# Verify Ghostscript version (should be 9.53 or later)
gs --version

# Check for vulnerable versions in package manager (Debian/Ubuntu)
apt list --installed 2>/dev/null | grep ghostscript

# Check for vulnerable versions (RHEL/CentOS)
rpm -qa | grep ghostscript