CVE-2023-24291: Portable Puzzle Collection Buffer Overflow

CVE-2023-24291 is a buffer overflow vulnerability in Portable Puzzle Collection affecting versions before 20230116.5782e29. Attackers can exploit the record length parameter to cause system crashes or execute malicious code. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2023-24291 Overview

CVE-2023-24291 is a buffer overflow vulnerability in Simon Tatham's Portable Puzzle Collection prior to commit 20230116.5782e29. The flaw resides in the handling of the record length parameter when parsing saved game files. A crafted input can overflow a fixed-size buffer, leading to memory corruption within the puzzle process. The issue is classified under [CWE-120] (Buffer Copy without Checking Size of Input). Exploitation requires local access and user interaction to load a malicious game record.

Critical Impact
A local attacker who convinces a user to load a crafted saved-game file can trigger a buffer overflow that may crash the puzzle application.

Affected Products

Simon Tatham's Portable Puzzle Collection versions before 20230116.5782e29
Debian packages shipping the affected sgt-puzzles builds
Downstream distributions repackaging pre-patch puzzle binaries

Discovery Timeline

2026-09-14 - CVE-2023-24291 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2023-24291

Vulnerability Analysis

The Portable Puzzle Collection parses serialized game state from save files. Each record in the save format is preceded by a length parameter. The affected code trusts this length without validating it against destination buffer size. Supplying an oversized length value causes downstream copy operations to write past allocated memory. This corruption typically triggers a segmentation fault, producing a local availability impact on the puzzle process.

The defect is confined to the puzzle binaries and does not cross privilege boundaries. Because puzzle applications run under the invoking user's context, exploitation does not yield elevated privileges. The EPSS score reflects a low observed likelihood of exploitation activity.

Root Cause

The root cause is missing bounds validation on an attacker-controlled length field in the save-file parser. The parser reads the record length and uses it directly in memory copy logic. No check confirms the length fits within the destination buffer. This pattern matches [CWE-120] classic buffer overflow behavior.

Attack Vector

An attacker must deliver a malicious saved-game file to a user of the affected puzzle software. The user must then load the file into the puzzle application. The overflow executes in the user's local context. Network delivery is possible only through indirect channels such as email or file sharing, since the vulnerability itself requires local file loading.

No verified public exploit code is available for this issue. For technical details, review the Tartarus Git Commit Update and the Debian Bug Report #1028986.

Detection Methods for CVE-2023-24291

Indicators of Compromise

Unexpected crashes or segmentation faults in sgt-puzzles binaries such as net, mines, or solo
Core dump files generated by puzzle processes referencing corrupted stack or heap regions
Saved game files received from untrusted sources containing anomalously large record length fields

Detection Strategies

Monitor endpoint logs for repeated crashes of puzzle processes tied to file open operations
Inspect saved-game file headers for record length values exceeding expected serialization bounds
Compare installed puzzle package versions against the 20230116.5782e29 commit baseline

Monitoring Recommendations

Enable core dump collection on Linux workstations to capture crash artifacts for triage
Track package inventory across managed endpoints to identify unpatched sgt-puzzles installations
Alert on process termination signals SIGSEGV and SIGABRT originating from puzzle binaries

How to Mitigate CVE-2023-24291

Immediate Actions Required

Update Portable Puzzle Collection to a build containing commit e5717d1ba2184eb6e38b4e2a9d29dc4704aeef30 or later
Apply distribution security updates for sgt-puzzles from Debian or the downstream vendor
Avoid loading saved-game files received from untrusted sources until patching completes

Patch Information

The upstream fix is available in the Tartarus Git repository at commit e5717d1ba2184eb6e38b4e2a9d29dc4704aeef30. Debian tracks the issue under Debian Bug Report #1028986. Users should install the vendor-provided package update rather than patching binaries manually.

Workarounds

Restrict use of the puzzle applications to trusted saved-game files only
Remove the affected package from shared or multi-user systems where untrusted files may be introduced
Run the puzzle binaries inside a sandbox such as firejail to contain any crash or memory corruption

bash

# Example: sandbox puzzle binary execution with firejail
firejail --seccomp --private --net=none /usr/games/sgt-net