CVE-2023-24284: Portable Puzzle Collection Buffer Overflow

CVE-2023-24284 Overview

CVE-2023-24284 is a buffer overflow vulnerability in Simon Tatham's Portable Puzzle Collection prior to commit 5782e29, dated 2023-01-16. The flaw resides in the is_markable() function and is classified under [CWE-120] (Buffer Copy without Checking Size of Input). Exploitation requires local access and high attack complexity, and can affect availability of the puzzle application. The issue was addressed upstream in commit 5279fd24b2f4 and tracked as Debian bug #1028986.

Critical Impact
Local, low-severity availability impact through a buffer overflow in the puzzle logic; no confidentiality or integrity impact is reported.

Affected Products

Simon Tatham's Portable Puzzle Collection versions prior to commit 5782e29 (2023-01-16)
Debian packages tracked under bug report #1028986
Downstream distributions shipping the pre-patch puzzles source tree

Discovery Timeline

2026-09-14 - CVE-2023-24284 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2023-24284

Vulnerability Analysis

The vulnerability is a buffer overflow within the is_markable() function of the Portable Puzzle Collection. The affected code path processes puzzle state without sufficiently validating input size against the destination buffer. An attacker able to supply a crafted puzzle input can trigger memory corruption during local execution of the vulnerable binary.

Because the attack vector is local and the complexity is high, exploitation requires specific runtime conditions and local interaction with the vulnerable process. The reported impact is limited to application availability, meaning the primary observable consequence is a process crash rather than data disclosure or modification.

Root Cause

The root cause is missing bounds validation in is_markable() when copying or indexing puzzle data. This is a classic [CWE-120] pattern in which the code assumes input length constraints that the caller does not enforce. See the upstream fix in Tartarus Commit 5279fd24b2f4 for the specific corrections applied to the function.

Attack Vector

An attacker requires local access to a system running a vulnerable build of the Portable Puzzle Collection. The attacker supplies a specially crafted puzzle description or game state that reaches is_markable(). The overflow then corrupts adjacent memory, typically resulting in a crash of the puzzle process. See the Debian Bug Report #1028986 for reproduction context.

No verified proof-of-concept code is published for CVE-2023-24284.
Refer to the upstream commit and Debian bug report for technical detail.

Detection Methods for CVE-2023-24284

Indicators of Compromise

Repeated crashes of Portable Puzzle Collection binaries when loading user-supplied puzzle files
Core dumps referencing the is_markable() symbol in stack traces
Presence of puzzles package versions predating the 5279fd24b2f4 upstream commit

Detection Strategies

Inventory installed puzzle binaries and compare source commit hashes against the fixed commit 5279fd24b2f4
Enable core dump collection on multi-user systems and review crash traces for the vulnerable function
Track distribution security advisories referencing Debian bug #1028986 for downstream package status

Monitoring Recommendations

Monitor process termination and segmentation fault events for user-space puzzle applications
Alert on unexpected reads of untrusted puzzle files from network shares or removable media
Correlate crash telemetry with the loading of externally sourced puzzle save files

How to Mitigate CVE-2023-24284

Immediate Actions Required

Update the Portable Puzzle Collection to a build that includes upstream commit 5279fd24b2f4 or later
Apply the fixed puzzles package from your Linux distribution when it becomes available
Avoid opening puzzle save files from untrusted sources on multi-user systems

Patch Information

The upstream fix is available in the Tartarus git repository at commit 5279fd24b2f4a51e760bfde873fe1d29547220a6, which is included in Portable Puzzle Collection builds from 2023-01-16 (5782e29) onward. Distribution maintainers should rebuild affected packages against this or a later revision. Debian users should track Debian Bug Report #1028986 for package availability.

Workarounds

Restrict execution of vulnerable puzzle binaries to trusted local users only
Do not load puzzle state files supplied by unknown or untrusted parties
Remove or disable the affected puzzles package on shared systems until patched builds are installed

bash

# Verify the installed puzzles package version on Debian-based systems
dpkg -l | grep -i puzzles
apt-cache policy sgt-puzzles

# Upgrade to the fixed package once available
sudo apt update
sudo apt install --only-upgrade sgt-puzzles