libcue flaw turns a downloaded .cue file into code execution on GNOME

GitHub Security Lab has disclosed CVE-2023-43641, a memory corruption vulnerability in libcue, a small library for parsing cue sheets. The bug was found by Kevin Backhouse and reported through the distros mailing list in coordination with libcue maintainer Ilya Lipnitskiy. While libcue itself is obscure, it sits inside tracker-miners, the indexing service shipped with GNOME, which turns the flaw into a one-click remote code execution on default desktop installs of several Linux distributions.

Why libcue matters

Cue sheets are a metadata format describing CD track layouts, commonly paired with FLAC audio files. That makes libcue a dependency of audio players like Audacious. But the more consequential consumer is tracker-miners, which GNOME uses to index files in the user's home directory for search. The index updates automatically when files appear in certain locations, including ~/Downloads.

That combination means a victim only needs to click a malicious link. The downloaded file lands in ~/Downloads with a .cue extension, tracker-extract picks it up and parses it with libcue, and the malformed cue sheet triggers the vulnerability. Tracker-miners includes parsers for many formats besides cue sheets—HTML, JPEG, and PDF among them—but cue sheets are the attack vector here.

The researcher is delaying release of the full proof of concept to give users time to patch, but a crash-only test file is available. The exploit was tuned for Ubuntu 23.04 and Fedora 38; on the correct distribution it works reliably, and on the wrong one it simply segfaults.

The bug itself

libcue is mostly a bison grammar with data structures for parsed output. The vulnerability lives in handling of the INDEX syntax. Replacing an INDEX statement with a crafted overflow value triggers it.

Two problems compound. First, the scanner in cue_scanner.l at line 132 uses atoi to parse integers:

atoi performs no overflow checking, so a large unsigned value such as 4294567296 is silently converted to the negative integer -400000.

Second, and critically, the function track_set_index in cd.c does not verify that the index value is non-negative. If it is negative, the code can write outside the bounds of the array. Since the value being written is also attacker-controlled, the primitive is strong—arbitrary out-of-bounds write under attacker influence.

The fix is a single added condition on the existing if-statement in track_set_index, as in the proposed patch:

Tracker-miners as an attack amplifier

The vulnerability is not in tracker-miners itself, but that service magnifies its impact. Tracker-miners runs two processes:

  • tracker-miner-fs, a persistent background process
  • tracker-extract, started on demand to scan new files

tracker-miner-fs uses inotify to watch directories including ~/Downloads, ~/Music, and ~/Videos. New files trigger a tracker-extract process, which scans the file, reports the results back, and exits after a few seconds. Only tracker-extract is vulnerable because that is where libcue is used. Both processes run as the current user, so the bug yields no privilege escalation on its own.

If tracker-miners is not running, the bug cannot trigger. Checking with ps aux | grep track usually shows tracker-miner-fs active and tracker-extract idle. If neither is running, using the GNOME search bar should restart the service. Tracker-miners is tightly integrated into GNOME, with no simple settings toggle to disable it.

The two-process design is convenient for exploitation. A freshly spawned process has a more predictable memory layout than a long-running one, and tracker-extract always creates a fresh thread to scan the incoming file. The heap layout of that thread's malloc arena is highly consistent on a given distribution—identical every run on Ubuntu 23.04 or Fedora 38, albeit slightly different between the two. A failed exploit could also simply crash tracker-extract and wait for the next file to trigger a new process.

An accidental sandbox escape

The hard part of building the exploit was bypassing ASLR. The researcher also discovered partway through that tracker-extract runs a seccomp sandbox designed to block such attacks. The first working attempt failed with the message "Disallowed syscall "close_range" caught in sandbox". Rather than recognizing this as a sandbox escape problem, the route was changed to avoid close_range, and the new path succeeded.

The escape turned out to be accidental—a change made while reworking the PoC unintentionally solved it, and a one-line change could have fixed the original approach. In response, GNOME developer Carlos Garnacho has since committed hardening changes to the sandbox that block this exploitation path.

Update your GNOME system

This case demonstrates how a vulnerability in an unglamorous parsing library can become a serious remote code execution vector through the way it gets pulled into a desktop indexing service. The coordinated release date gives distro users time to install the libcue patch. Full exploit details are planned for a follow-up publication.