CVE-2024-46953: Ghostscript Path Traversal Vulnerability

CVE-2024-46953 Overview

An integer overflow vulnerability has been discovered in Artifex Ghostscript before version 10.04.0, specifically in the base/gsdevice.c file. This vulnerability occurs when parsing the filename format string used for output filenames, resulting in path truncation that can lead to path traversal and potential code execution.

Ghostscript is a widely-used interpreter for PostScript and PDF files, commonly deployed in document processing pipelines, print servers, and image conversion utilities across Linux distributions and enterprise environments. The vulnerability's presence in a core component of Ghostscript makes it particularly concerning for organizations processing untrusted documents.

Critical Impact

An attacker who can provide a malicious document to a Ghostscript installation could exploit this integer overflow to traverse file system paths and potentially execute arbitrary code on the target system.

Affected Products

• Artifex Ghostscript versions prior to 10.04.0
• Debian Linux 12.0
• SUSE Linux Enterprise High Performance Computing 12.0 SP5
• SUSE Linux Enterprise Server 12 SP5 (including LTSS and LTSS Extended Security)
• SUSE Linux Enterprise Server for SAP 12 SP5

Discovery Timeline

• 2024-11-10 - CVE-2024-46953 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-46953

Vulnerability Analysis

This vulnerability is classified as CWE-190 (Integer Overflow or Wraparound). The flaw exists in the filename format string parsing logic within base/gsdevice.c. When Ghostscript processes output filenames, it performs calculations to determine buffer sizes and path lengths. An attacker can craft input that causes these calculations to overflow, resulting in a smaller-than-expected buffer allocation or incorrect path length computation.

The integer overflow leads to path truncation, where the intended file path is cut short in unexpected ways. This truncation can be weaponized to achieve path traversal, allowing an attacker to write files outside the intended directory. In worst-case scenarios, this can be chained with other techniques to achieve arbitrary code execution on the affected system.

The vulnerability requires local access and user interaction, typically triggered when a user processes a maliciously crafted PostScript or PDF file through Ghostscript.

Root Cause

The root cause lies in insufficient validation of integer arithmetic operations in the filename format string parser. When calculating the output filename path, the code fails to properly check for integer overflow conditions before allocating memory or computing string lengths. This allows attackers to provide specially crafted format strings that cause the integer values to wrap around, resulting in truncated paths that bypass intended directory restrictions.

Attack Vector

The attack requires local access to the system and user interaction. An attacker would need to convince a user or automated process to open a maliciously crafted PostScript or PDF document with Ghostscript. The malicious document would contain specially crafted output filename directives designed to trigger the integer overflow.

Attack scenarios include:

• Sending a malicious document to a print server that uses Ghostscript for processing
• Targeting document conversion services that process user-uploaded files
• Exploiting automated document processing pipelines in enterprise environments

The vulnerability mechanism involves crafting filename format strings with carefully calculated values that cause integer overflow during path computation. When the overflow occurs, the resulting truncated path can point to arbitrary locations in the file system. Technical details of the exploitation mechanism can be found in the Ghostscript Bug Report.

Detection Methods for CVE-2024-46953

Indicators of Compromise

• Unexpected file writes outside of designated Ghostscript output directories
• Presence of files with unusual or truncated names in sensitive system directories
• Ghostscript processes attempting to access or write to unauthorized file paths
• Anomalous PostScript or PDF files with unusually long or complex output device specifications

Detection Strategies

• Monitor Ghostscript process activity for file operations outside expected directories using file integrity monitoring tools
• Implement application-level logging to capture output filename parameters passed to Ghostscript
• Deploy endpoint detection rules that alert on path traversal patterns in Ghostscript command-line arguments
• Use SentinelOne's behavioral AI to detect anomalous file system access patterns from document processing applications

Monitoring Recommendations

• Enable comprehensive logging for all Ghostscript invocations, including full command-line parameters
• Monitor for creation of files in sensitive directories (e.g., /etc, /usr/bin, system startup locations) by Ghostscript processes
• Implement network monitoring to detect exfiltration attempts following potential exploitation
• Review document processing logs for unusual filename patterns or format string characters

How to Mitigate CVE-2024-46953

Immediate Actions Required

• Upgrade Artifex Ghostscript to version 10.04.0 or later immediately
• Apply vendor-provided security patches for affected Linux distributions (Debian, SUSE)
• Restrict Ghostscript processing to trusted documents only until patched
• Implement application sandboxing to limit Ghostscript's file system access

Patch Information

Artifex has released a patch addressing this vulnerability in Ghostscript version 10.04.0. The fix is available in the Ghostscript Commit Update with commit hash 1f21a45df0fa3abec4cff12951022b192dda3c00.

Distribution-specific patches are available:

• SUSE: See SUSE Security Update Announcement
• Debian: See Debian LTS Announcement

Workarounds

• Run Ghostscript in a sandboxed environment with restricted file system permissions
• Use -dSAFER mode when running Ghostscript to enable additional security restrictions
• Configure file system permissions to limit write access from Ghostscript processes
• Implement input validation to reject documents with suspicious output filename specifications

# Configuration example - Running Ghostscript with safer mode and restricted output directory
gs -dSAFER -dBATCH -dNOPAUSE \
   -sDEVICE=pdfwrite \
   -sOutputFile=/restricted/output/dir/%d.pdf \
   input.ps

# Verify Ghostscript version to ensure patched version is installed
gs --version
# Expected: 10.04.0 or later