CVE-2020-15900: Ghostscript Privilege Escalation Flaw

CVE-2020-15900 Overview

A critical memory corruption vulnerability was discovered in Artifex Ghostscript versions 9.50 and 9.52. The flaw exists in the rsearch PostScript operator implementation within psi/zstring.c, where an incorrect size calculation can cause an integer underflow. When calculating the 'post' size, the result could be too large and underflow to the maximum uint32_t value, leading to memory corruption. This vulnerability can be exploited through maliciously crafted PostScript files to override file access controls.

Critical Impact
This integer underflow vulnerability allows attackers to corrupt memory and potentially override file access controls through specially crafted PostScript documents, enabling remote code execution without authentication.

Affected Products

Artifex Ghostscript 9.50
Artifex Ghostscript 9.52
Canonical Ubuntu Linux 20.04 LTS
openSUSE Leap 15.1
openSUSE Leap 15.2

Discovery Timeline

2020-07-28 - CVE-2020-15900 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-15900

Vulnerability Analysis

The vulnerability resides in the PostScript interpreter's handling of the rsearch operator in the psi/zstring.c source file. The root issue is an integer underflow condition that occurs during size calculations for string operations. When the rsearch operator processes specially crafted input, the calculation for the 'post' size can produce a value that exceeds expected bounds. This miscalculation causes the size to underflow to the maximum uint32_t value (4,294,967,295), resulting in severe memory corruption.

The impact is significant because Ghostscript is widely deployed as a document processing engine, used by printing systems, document conversion tools, and PDF viewers. An attacker can exploit this vulnerability by convincing a user or automated system to process a malicious PostScript or PDF file. Successful exploitation could lead to arbitrary code execution with the privileges of the Ghostscript process, potentially compromising the entire system.

Root Cause

The vulnerability stems from improper integer arithmetic in the rsearch function within psi/zstring.c. The original code used r_set_size() for size assignments without proper bounds checking. The size calculation for the 'post' portion of the search result could produce a negative value when specific string patterns were matched, which when cast to an unsigned integer would wrap around to an extremely large value. This is classified as CWE-191 (Integer Underflow).

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction beyond file processing. An attacker can deliver a malicious PostScript file through various channels:

Email attachments containing crafted PS or PDF files
Web-based document preview systems
Print servers processing untrusted documents
Automated document conversion pipelines

The malicious PostScript file would contain a non-standard operator sequence designed to trigger the integer underflow in the rsearch calculation, corrupting memory and potentially allowing arbitrary code execution.

// Security patch from psi/zstring.c
// Source: https://github.com/ArtifexSoftware/ghostpdl/commit/5d499272b95a6b890a1397e11d20937de000d31b

    return 0;
found:
    op->tas.type_attrs = op1->tas.type_attrs;
-    op->value.bytes = ptr;
-    r_set_size(op, size);
+    op->value.bytes = ptr;				/* match */
+    op->tas.rsize = size;				/* match */
    push(2);
-    op[-1] = *op1;
-    r_set_size(op - 1, ptr - op[-1].value.bytes);
-    op1->value.bytes = ptr + size;
-    r_set_size(op1, count + (!forward ? (size - 1) : 0));
+    op[-1] = *op1;					/* pre */
+    op[-3].value.bytes = ptr + size;			/* post */
+    if (forward) {
+        op[-1].tas.rsize = ptr - op[-1].value.bytes;	/* pre */
+        op[-3].tas.rsize = count;			/* post */
+    } else {
+        op[-1].tas.rsize = count;			/* pre */
+        op[-3].tas.rsize -= count + size;		/* post */
+    }
    make_true(op);
    return 0;
}

The patch replaces the vulnerable r_set_size() calls with direct assignments to tas.rsize and introduces conditional logic to handle forward and reverse search directions separately, preventing the integer underflow condition.

Detection Methods for CVE-2020-15900

Indicators of Compromise

Unexpected Ghostscript process crashes or segmentation faults during document processing
Anomalous memory allocation patterns in Ghostscript processes
PostScript files containing unusual rsearch operator sequences with large string parameters
Suspicious PDF or PS files from untrusted sources triggering document conversion failures

Detection Strategies

Monitor for Ghostscript process crashes with memory corruption signatures in system logs
Implement file integrity monitoring for systems running vulnerable Ghostscript versions
Deploy network-based detection rules to identify malicious PostScript content patterns
Review process execution logs for unexpected child processes spawned by Ghostscript

Monitoring Recommendations

Enable verbose logging for document processing pipelines to capture Ghostscript errors
Implement endpoint detection monitoring for memory corruption exploitation techniques
Configure SIEM alerts for repeated Ghostscript failures from specific sources
Monitor system call patterns from Ghostscript processes for anomalous behavior

How to Mitigate CVE-2020-15900

Immediate Actions Required

Update Artifex Ghostscript to version 9.53 or later immediately
Apply available security patches from distribution repositories (Ubuntu USN-4445-1, Gentoo GLSA-202008-20, openSUSE security advisories)
Restrict Ghostscript from processing untrusted documents until patched
Consider sandboxing Ghostscript processes to limit exploitation impact

Patch Information

The vulnerability was fixed in Ghostscript commit 5d499272b95a6b890a1397e11d20937de000d31b. Organizations should update to Ghostscript version 9.53 or later, which includes this security fix. Distribution-specific patches are available:

Workarounds

Configure Ghostscript with -dSAFER mode to restrict file operations until patching is possible
Implement input validation to block PostScript files from untrusted sources
Use application sandboxing (containers, AppArmor, SELinux) to isolate Ghostscript processes
Disable automatic document preview functionality that relies on Ghostscript

bash

# Configuration example - Running Ghostscript in safer mode
gs -dSAFER -dBATCH -dNOPAUSE -sDEVICE=pdfwrite -sOutputFile=output.pdf input.ps

# Verify Ghostscript version (should be 9.53 or later)
gs --version

# Check for vulnerable versions in package manager (Debian/Ubuntu)
apt list --installed 2>/dev/null | grep ghostscript

# Check for vulnerable versions (RHEL/CentOS)
rpm -qa | grep ghostscript