CVE-2024-45107: Adobe Acrobat Use-After-Free Vulnerability

CVE-2024-45107 Overview

CVE-2024-45107 is a Use After Free vulnerability affecting Adobe Acrobat Reader that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass security mitigations such as Address Space Layout Randomization (ASLR). Exploitation of this issue requires user interaction in that a victim must open a malicious file, making it a local attack vector vulnerability.

Critical Impact

Successful exploitation allows attackers to bypass ASLR protections and access sensitive memory contents, potentially enabling further exploitation of the target system.

Affected Products

• Adobe Acrobat (Classic versions)
• Adobe Acrobat DC (Continuous versions up to 24.002.20991)
• Adobe Acrobat Reader (Classic versions up to 20.005.30636)
• Adobe Acrobat Reader DC (Continuous versions)
• Affected on Microsoft Windows and Apple macOS platforms

Discovery Timeline

• 2024-09-05 - CVE-2024-45107 published to NVD
• 2024-09-06 - Last updated in NVD database

Technical Details for CVE-2024-45107

Vulnerability Analysis

This Use After Free (CWE-416) vulnerability exists in Adobe Acrobat Reader when processing specially crafted PDF files. The flaw occurs when the application references memory after it has been freed, resulting in undefined behavior that can be exploited to disclose sensitive memory contents.

The vulnerability impacts confidentiality by allowing unauthorized access to memory contents. While the attack complexity is low, it requires local access and user interaction—specifically, a victim must be tricked into opening a malicious PDF document. The vulnerability does not directly impact system integrity or availability, focusing instead on information disclosure that could facilitate subsequent attacks.

Root Cause

The root cause is a Use After Free (UAF) memory corruption issue classified under CWE-416. This occurs when Adobe Acrobat Reader continues to reference a memory location after the memory has been deallocated. When memory is freed but pointers to that memory are not properly invalidated, subsequent use of those dangling pointers can result in reading arbitrary memory contents.

Attack Vector

The attack vector is local and requires user interaction. An attacker must craft a malicious PDF file designed to trigger the Use After Free condition when processed by Adobe Acrobat Reader. The attack scenario typically involves:

1. Attacker creates a specially crafted PDF document that triggers the UAF condition
2. Victim is social engineered into opening the malicious PDF file
3. Upon opening, the vulnerability is triggered, allowing memory disclosure
4. Leaked memory contents can reveal ASLR base addresses or other sensitive data
5. This information can be used to bypass ASLR and facilitate further exploitation

The vulnerability requires the attacker to deliver the malicious file to the victim through phishing emails, malicious websites, or other delivery mechanisms. Without user interaction to open the file, the vulnerability cannot be exploited.

Detection Methods for CVE-2024-45107

Indicators of Compromise

• Unusual PDF files with abnormal object structures or suspicious embedded content
• Adobe Acrobat Reader crashes or unexpected termination when opening PDF documents
• Anomalous memory access patterns in Acrobat Reader processes
• PDF files received from untrusted or unexpected sources

Detection Strategies

• Monitor for Adobe Acrobat Reader process crashes that may indicate exploitation attempts
• Implement file scanning for malformed PDF documents with suspicious characteristics
• Deploy endpoint detection and response (EDR) solutions capable of detecting memory corruption exploitation
• Enable enhanced logging for PDF processing applications

Monitoring Recommendations

• Configure SentinelOne to monitor Adobe Acrobat Reader process behavior for anomalous memory access
• Implement email gateway scanning to detect and quarantine suspicious PDF attachments
• Review application crash logs for patterns indicating exploitation attempts
• Monitor network traffic for suspicious PDF file downloads from untrusted sources

How to Mitigate CVE-2024-45107

Immediate Actions Required

• Update Adobe Acrobat Reader to versions newer than 24.002.20991 (Continuous) or 20.005.30636 (Classic 2020)
• Enable Protected Mode and Protected View in Adobe Acrobat Reader settings
• Implement strict email attachment policies to filter potentially malicious PDF files
• Train users to avoid opening PDF files from untrusted sources

Patch Information

Adobe has released security updates to address this vulnerability as documented in Adobe Security Advisory APSB24-57. Organizations should prioritize updating to the latest patched versions:

• Acrobat DC (Continuous): Update to versions after 24.002.20991
• Acrobat Reader DC (Continuous): Update to versions after 24.002.20991
• Acrobat 2020 (Classic): Update to versions after 20.005.30636
• Acrobat Reader 2020 (Classic): Update to versions after 20.005.30636

Workarounds

• Enable Protected Mode in Adobe Acrobat Reader to sandbox document processing
• Configure Protected View to open documents from untrusted sources in a restricted mode
• Use alternative PDF readers until patches can be applied
• Implement application whitelisting to control PDF processing applications

# Windows Registry: Enable Protected Mode for Adobe Acrobat Reader DC
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\Privileged" /v bProtectedMode /t REG_DWORD /d 1 /f

# Windows Registry: Enable Protected View for files from Internet
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v bEnableProtectedViewFromInternet /t REG_DWORD /d 1 /f