SB20261110282 - Multiple vulnerabilities in kitty

Description

This security bulletin contains information about 2 vulnerabilities.

1) Buffer underflow (CVE-ID: N/A)

CWE-ID: CWE-124 - Buffer Underwrite ('Buffer Underflow')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code on the system running kitty.

The vulnerability exists due to a buffer underwrite in next_word() in kitty/launcher/shlex.h when processing OSC 133 quoted strings without clearing prev_word_ch between parser states. A remote attacker can trick a victim into displaying crafted terminal output containing repeated single quotes after a dollar sign to decrement the buffer position and overwrite heap memory, causing crashes or potentially executing arbitrary code with adequate heap grooming.

2) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read or overwrite local files without transfer confirmation and execute arbitrary code on the system running kitty.

The vulnerability exists due to missing authentication in check_bypass() in kitty/file_transmission.py when the kitty-1 protocol accepts an empty password without checking whether file_transfer_confirmation_bypass is configured. A remote attacker can induce a user to establish an active malicious connection that receives $KITTY_PUBLIC_KEY, then initiate unauthorized file transfers to disclose files or overwrite shell startup or kitty configuration files to execute arbitrary code.

Remediation

Install update from vendor's website.

References

• https://github.com/kovidgoyal/kitty/security/advisories/GHSA-86c2-9jg7-6v94
• https://github.com/kovidgoyal/kitty/security/advisories/GHSA-2cmm-wgmm-8jjr