Listen to this Post
The vulnerability in Quill before version v0.7.1 stems from insufficient validation of size fields when parsing Mach-O binaries. Specifically, during the handling of the LC_CODE_SIGNATURE load command, Quill reads multiple size and count fields—such as DataSize, DataOffset, and Size from the load command, Count from the SuperBlob header, and Length from individual blob headers—without verifying that these values are reasonable or consistent with the actual file size. An attacker can craft a minimal Mach-O binary (approximately 4KB) containing extremely large values in these fields. When Quill processes this malicious binary, it attempts to allocate memory buffers based on the attacker-controlled sizes, leading to unbounded memory allocation. This can rapidly exhaust available memory, causing the process to crash or become unresponsive, resulting in a denial of service. Both the Quill CLI and the underlying Go library are affected when used to parse untrusted Mach-O files. The issue is particularly critical in environments like CI/CD pipelines, shared signing services, or any workflow where externally submitted binaries are accepted for signing. The vulnerability is fixed in Quill version v0.7.1 by adding proper validation to ensure size fields are within safe limits and consistent with the file’s actual size. No workarounds are available; upgrading is the only mitigation. The issue was reported by opera-aklajn (Opera) and credited by Anchore.
Platform: Quill
Version: < v0.7.1
Vulnerability: Unbounded memory allocation
Severity: Critical
date: Unknown
Prediction: Already patched
What Undercode Say:
Check installed Quill version
quill --version
Simulate triggering the vulnerability (requires a crafted Mach-O file)
quill inspect malicious.macho
Example using Go to trigger the vulnerability
cat > trigger.go << EOF
package main
import (
"os"
"github.com/anchore/quill/quill"
)
func main() {
data, _ := os.ReadFile("malicious.macho")
macho, _ := quill.ParseMachO(data)
macho.CodeSignature() // This will attempt huge allocation
}
EOF
go run trigger.go
Exploit:
An attacker crafts a Mach-O binary with a tampered LC_CODE_SIGNATURE load command. Using a hex editor, they set the DataSize field to a value like 0xFFFFFFFF, the SuperBlob Count to 0xFFFFFF, and blob Length fields to similarly huge numbers. When Quill parses this file, it allocates memory based on these forged values, leading to memory exhaustion. The malicious binary can be as small as 4KB, making it easy to deliver via upload or email.
Protection from this CVE:
Upgrade Quill to version v0.7.1 or later. If upgrading is not immediately possible, avoid processing untrusted Mach-O binaries, especially in automated pipelines. Implement additional input validation and resource limits at the system level to mitigate the impact of excessive memory allocation.
Impact:
Successful exploitation causes memory exhaustion, leading to a denial of service. The Quill process crashes, potentially disrupting signing operations in CI/CD pipelines, shared signing services, or any environment that accepts external binaries for processing. This can halt builds, delay releases, or cause cascading failures in dependent systems.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
