CVE-2023-24288: Puzzle Collection DoS Vulnerability

CVE-2023-24288 Overview

CVE-2023-24288 affects Simon Tatham's Portable Puzzle Collection before version 20230116.5782e29. The vulnerability allows a local attacker to trigger a Denial of Service (DoS) by creating an excessive number of save states. The underlying weakness is classified as [CWE-190] Integer Overflow or Wraparound. The issue was resolved in upstream commit b3d4a4197954c21ac78b68c58dff8f84fe743ea2 and tracked in Debian Bug Report #1028986.

Critical Impact
A local attacker interacting with a vulnerable puzzle binary can exhaust resources and crash the application through repeated save state creation.

Affected Products

Simon Tatham's Portable Puzzle Collection versions before 20230116.5782e29
Debian packages shipping the affected sgt-puzzles builds
Downstream distributions bundling the pre-patch source tree

Discovery Timeline

2026-09-14 - CVE-2023-24288 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2023-24288

Vulnerability Analysis

The flaw resides in the save state handling logic of the Portable Puzzle Collection. When a user creates a large number of save states, an integer overflow condition ([CWE-190]) occurs during size or counter arithmetic. The overflow leads to incorrect allocation behavior and process termination, producing a Denial of Service. Because the attack vector is local and requires no privileges or user interaction beyond running the puzzle, the practical risk is limited to availability of the affected application.

Root Cause

The root cause is unchecked arithmetic on values that track save state counts or buffer sizes. When these values exceed their maximum representable range, they wrap around and corrupt internal bookkeeping. The upstream fix in commit b3d4a41 adds bounds validation to prevent the overflow condition. Details are documented in the Tartarus Git Commit b3d4a41.

Attack Vector

An attacker with local access to a session running a vulnerable puzzle binary repeatedly invokes the save state operation. Once the counter overflows, the application crashes or becomes unresponsive. No network access, authentication, or elevated privileges are required, but exploitation is limited to the local user's own process.

No verified proof-of-concept code is available. Refer to the Debian Bug Report #1028986 for reproduction context.

Detection Methods for CVE-2023-24288

Indicators of Compromise

Unexpected termination or crash logs from sgt-puzzles or related puzzle binaries
Core dumps generated by puzzle processes following repeated save state operations
Abnormally large in-memory or on-disk state files associated with puzzle applications

Detection Strategies

Inventory installed puzzle package versions and compare against the fixed commit b3d4a4197954c21ac78b68c58dff8f84fe743ea2.
Monitor process crash telemetry on Linux endpoints for repeated failures of puzzle binaries.
Correlate high-frequency save state file writes with subsequent process termination events.

Monitoring Recommendations

Enable system crash reporting (for example, systemd-coredump) to capture terminations of interactive desktop applications.
Track package versions of sgt-puzzles through configuration management tooling.
Review desktop application logs for abnormal exit codes tied to save state actions.

How to Mitigate CVE-2023-24288

Immediate Actions Required

Upgrade the Portable Puzzle Collection to a build that includes commit b3d4a41 or later.
Apply distribution updates from Debian and other downstream package maintainers once available.
Restrict use of vulnerable puzzle binaries on shared or multi-user systems until patched.

Patch Information

The upstream fix is committed to the Tartarus Git repository as b3d4a4197954c21ac78b68c58dff8f84fe743ea2. Users should install builds dated 20230116.5782e29 or newer. Debian tracks the issue in bug report #1028986 and ships fixed packages through standard security update channels.

Workarounds

Avoid creating large numbers of save states within a single puzzle session.
Remove or restrict execution of vulnerable puzzle binaries on systems where patching is delayed.
Rebuild the puzzle collection from the patched upstream source if distribution packages are unavailable.

bash

# Rebuild from patched upstream source
git clone https://git.tartarus.org/simon/puzzles.git
cd puzzles
git checkout b3d4a4197954c21ac78b68c58dff8f84fe743ea2
cmake .
make