CVE-2023-24287 Overview
CVE-2023-24287 is a buffer overflow vulnerability in Simon Tatham's Portable Puzzle Collection before version 20230116.5782e29. The flaw resides in the handling of the M command and is classified under [CWE-120] (Buffer Copy without Checking Size of Input). An attacker with local access can trigger the overflow by supplying crafted input to a vulnerable puzzle binary. Successful exploitation results in a limited availability impact, typically causing the affected process to crash. The issue was addressed upstream in commit 952ef8ca565d803da1134466358bd85683a489a3 and tracked as Debian Bug #1028986.
Critical Impact
Local, low-complexity input handling flaw in the M command path that can crash the puzzle process, producing a low availability impact.
Affected Products
- Simon Tatham's Portable Puzzle Collection versions before 20230116.5782e29
- Downstream Debian packages of sgt-puzzles prior to the fixed release
- Third-party redistributions bundling vulnerable upstream sources
Discovery Timeline
- 2026-09-14 - CVE-2023-24287 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2023-24287
Vulnerability Analysis
The vulnerability is a stack or heap buffer overflow reachable through the M command handled by the Portable Puzzle Collection. The M command is part of the game state deserialization and move-parsing logic used by the puzzle engine. Because the input parser does not validate the size of the data associated with the command before copying it into a fixed-size buffer, oversized input overruns adjacent memory. Exploitation requires the attacker to supply a crafted saved-game or move string to a local puzzle binary. The observed impact is limited to process availability, with no confidentiality or integrity impact reported.
Root Cause
The root cause is missing bounds checking during parsing of the M command, categorized as [CWE-120]. The upstream fix in commit 952ef8ca565d803da1134466358bd85683a489a3 adds validation before the vulnerable copy operation. Refer to the Tartarus Git Commit 952ef8 for the corrective code.
Attack Vector
Exploitation requires local access to a vulnerable puzzle binary and user-supplied input containing a malformed M command. There is no network reachability and no authentication is required beyond local execution of the binary. No public exploit or proof-of-concept has been published, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified exploitation code is available. See the Debian Bug Report #1028986 for the original reproducer discussion.
Detection Methods for CVE-2023-24287
Indicators of Compromise
- Unexpected crashes or segmentation faults in sgt-puzzles binaries when loading saved game files
- Core dumps referencing move-parsing functions triggered by input containing M commands
- Malformed saved-game files delivered from untrusted sources
Detection Strategies
- Inventory installed puzzle packages and compare against fixed version 20230116.5782e29 or later
- Monitor for process termination events on puzzle binaries followed by core dump generation
- Inspect user-supplied puzzle save files for oversized command payloads before opening
Monitoring Recommendations
- Enable operating system crash reporting to capture faults in the puzzle binaries
- Track package versions on multi-user systems where the puzzle collection is installed
- Log opening of .sav files sourced from external or untrusted locations
How to Mitigate CVE-2023-24287
Immediate Actions Required
- Upgrade the Portable Puzzle Collection to a build that includes commit 952ef8ca565d803da1134466358bd85683a489a3 or later
- Apply distribution security updates that reference Debian Bug #1028986
- Avoid loading puzzle save files or move strings received from untrusted sources
Patch Information
The upstream fix is available in the Tartarus git repository as commit 952ef8ca565d803da1134466358bd85683a489a3, included in Portable Puzzle Collection version 20230116.5782e29 and later. Debian users should track the resolution reported in Debian Bug Report #1028986 and install the fixed package from their distribution's security channel.
Workarounds
- Restrict use of vulnerable puzzle binaries on shared or multi-user systems until patched
- Do not open puzzle save files or move sequences from unverified origins
- Remove the sgt-puzzles package on systems where it is not required
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
