CVE-2023-4863: Explaining the WebP Huffman-Table Overflow
· 18:00 · Watch on YouTube ↗
Summary
The video analyzes CVE-2023-4863, a WebP heap overflow in Huffman-table construction. It explains how malformed code-length data could exceed fixed allocations and discusses affected platforms and a reported iOS image-based zero-day.
Key points
- Citizenlab announced an actively exploited iOS zero-day; the video says a PassKit attachment sent in an iMessage was apparently the entry point.
- Apple issued an iOS update the same day, warning that processing a maliciously crafted image could lead to arbitrary code execution.
- The video examines a critical WebP heap buffer overflow in BuildHuffmanTable, described in the source commits as an out-of-bounds write.
- The speaker identifies iOS, Chromium, Android, Firefox, and ImageMagick as affected through their WebP support.
- The vulnerable code had been in the source since 2014, according to the video.
- The decoder builds Huffman tables from code-length data in an untrusted image, while fixed allocations were sized for valid trees; malformed data could make the tables exceed those allocations.
- At the time discussed, proof-of-concept .webp files triggered the overflow, but the speaker said full example exploits for specific targets were not available.
Article Details
- Topics
- [00:00] Reported iOS zero-day, PassKit attachment, and Apple update
- [00:37] WebP heap buffer overflow and affected software
- [02:15] Video scope and Huffman coding fundamentals
- [07:36] Huffman lookup tables and table-size growth
- [09:39] Two-level tables and fixed allocation sizes
- [12:46] How untrusted code-length data can overflow the table buffer