CVE-2023-43641: Libcue Out-of-Bounds RCE Vulnerability

CVE-2023-43641 Overview

CVE-2023-43641 is an out-of-bounds array access vulnerability in libcue, a library used to parse CUE sheet files. The flaw affects versions 2.2.1 and prior, and enables remote code execution on GNOME desktop systems through a one-click attack. When a user downloads a malicious .cue file from a webpage, GNOME's tracker-miners automatically indexes the file in ~/Downloads and invokes libcue to parse it. The crafted file then triggers the out-of-bounds write [CWE-787] and achieves code execution in the user's context. The issue is patched in libcue version 2.3.0.

Critical Impact
A one-click drive-by attack against GNOME Linux desktops yields arbitrary code execution under the logged-in user, with an EPSS exploit probability of 80.3%.

Affected Products

lipnitsk libcue versions 2.2.1 and prior
Fedora 37, 38, and 39
Debian Linux 10, 11, and 12

Discovery Timeline

2023-10-09 - GitHub Security Lab publishes coordinated disclosure of 1-click RCE on GNOME
2023-10-09 - CVE-2023-43641 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-43641

Vulnerability Analysis

The vulnerability resides in libcue's parser for CUE sheet files, a plaintext format used to describe the layout of audio CD tracks. Versions up to and including 2.2.1 contain an out-of-bounds array access [CWE-787] reachable through attacker-controlled file content. Because libcue is invoked by tracker-miners whenever a .cue file appears in an indexed directory, the parser is reachable without any explicit user action beyond saving the file.

The attack chain is notable because it combines a memory corruption primitive in a small parsing library with the default behavior of the GNOME desktop. Files saved to ~/Downloads are automatically scanned, and the .cue extension routes parsing to libcue. Successful exploitation grants code execution as the desktop user, providing a foothold for credential theft, lateral movement, or persistence on Linux workstations.

Root Cause

The libcue parser fails to validate array indices when processing track-related fields in a CUE sheet. A crafted sheet supplies index values that fall outside allocated bounds, allowing the parser to write to memory locations beyond the intended buffer. The patches in commits cfb98a060fd79dbc3463d85f0f29c3c335dfa0ea and fdf72c8bded8d24cfa0608b8e97f2eed210a920e introduce the bounds checks required to reject malformed input.

Attack Vector

An attacker hosts a malicious .cue file on a webpage. When the victim clicks a download link in a default GNOME browser configuration, the file is written to ~/Downloads. The tracker-miners service detects the new file, identifies its extension, and dispatches libcue to extract metadata. The crafted sheet triggers the out-of-bounds write during parsing, redirecting execution to attacker-controlled code with the privileges of the logged-in user. No additional user interaction beyond the download is required.

No verified proof-of-concept code is published in the NVD data. Technical analysis of the exploit chain is described in the GitHub Coordinated Disclosure post and the GHSA-5982-x7hv-r9cj advisory.

Detection Methods for CVE-2023-43641

Indicators of Compromise

Unexpected .cue files appearing in ~/Downloads or other directories indexed by tracker-miners
Crashes or abnormal terminations of tracker-extract or tracker-miner-fs processes after file ingestion
Child processes spawned from tracker-extract that do not match the expected metadata-extraction workflow
Outbound network connections originating from tracker-* processes shortly after a download event

Detection Strategies

Monitor process lineage for shells, interpreters, or network utilities launched as children of tracker-extract or related GNOME indexing services
Audit installed libcue package versions across Linux fleets and flag any below 2.3.0
Correlate browser download events with subsequent execution telemetry on the same host to catch one-click chains

Monitoring Recommendations

Enable EDR telemetry on Linux workstations to capture process creation, file write, and library load events around tracker-miners
Aggregate package inventory data in a centralized log platform to track patch coverage of libcue across Debian and Fedora hosts
Alert on core dumps generated by GNOME desktop services, which often indicate exploitation attempts against parser libraries

How to Mitigate CVE-2023-43641

Immediate Actions Required

Update libcue to version 2.3.0 or later on all affected Linux endpoints
Apply distribution updates from Debian DSA-5524 and the Fedora package announcements covering Fedora 37, 38, and 39
Restart tracker-miners services or reboot workstations after patching to ensure the vulnerable library is no longer loaded
Validate package versions across the fleet to confirm full patch coverage

Patch Information

The upstream fix is delivered through commits cfb98a0 and fdf72c8, released in libcue 2.3.0. Distribution-level patches are published in the Debian Security Advisory DSA-5524, the Debian LTS announcement, and Fedora package announcements for Fedora 37, 38, and 39.

Workarounds

Disable or mask the tracker-miners service to prevent automatic parsing of files saved to indexed directories
Remove .cue from the list of file extensions handled by tracker-extract until patching is complete
Restrict browser download locations to directories not indexed by tracker-miners
Advise users to avoid downloading .cue files from untrusted sources on unpatched systems

bash

# Disable tracker-miners until libcue is patched
systemctl --user mask tracker-miner-fs-3.service
systemctl --user mask tracker-extract-3.service
systemctl --user stop tracker-miner-fs-3.service tracker-extract-3.service

# Verify libcue version on Debian/Ubuntu
dpkg -l | grep libcue

# Verify libcue version on Fedora
rpm -q libcue