Dislocker
Monthly
Denial of service in Dislocker through 0.7.3 is triggered when the tool parses a crafted BitLocker volume image whose VMK or FVEK datum declares a datum_size smaller than the 36-byte AES-CCM header it must contain, causing an integer underflow that yields a near-4GB payload length and sends hexdump() into an out-of-bounds heap read that crashes the process. Exploitation is local and requires user interaction: a victim must actively point dislocker at the attacker-supplied image, which matches the assessed vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, unauthenticated but victim-driven. Impact is availability only - there is no memory corruption of confidentiality or integrity consequence described, no public exploit identified at time of analysis, and the defect is not listed as confirmed actively exploited (CISA KEV).
Denial of service and heap memory disclosure in Dislocker 0.7.3 and earlier: a crafted BitLocker volume image whose metadata announces inflated dataset or datum sizes pushes the parsing routines get_dataset() and get_next_datum() past the end of the allocated metadata buffer, crashing the tool or leaking adjacent heap memory through the volume-parsing output. Any default build of Dislocker at or below 0.7.3 that opens the malicious image is affected, which is of practical concern mainly to forensic, incident-response, and disk-recovery workflows that routinely process untrusted BitLocker volumes. Exploitation is local and requires the victim to actually open or mount the crafted image (UI:P), and no public exploit code has been identified at time of analysis; an upstream fix commit is available. This is a genuinely Medium-severity, lower-priority issue rather than an urgent one, and it is not noted as confirmed actively exploited (CISA KEV).
Denial of service in Dislocker through 0.7.3 is triggered when the tool parses a crafted BitLocker volume image whose VMK or FVEK datum declares a datum_size smaller than the 36-byte AES-CCM header it must contain, causing an integer underflow that yields a near-4GB payload length and sends hexdump() into an out-of-bounds heap read that crashes the process. Exploitation is local and requires user interaction: a victim must actively point dislocker at the attacker-supplied image, which matches the assessed vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, unauthenticated but victim-driven. Impact is availability only - there is no memory corruption of confidentiality or integrity consequence described, no public exploit identified at time of analysis, and the defect is not listed as confirmed actively exploited (CISA KEV).
Denial of service and heap memory disclosure in Dislocker 0.7.3 and earlier: a crafted BitLocker volume image whose metadata announces inflated dataset or datum sizes pushes the parsing routines get_dataset() and get_next_datum() past the end of the allocated metadata buffer, crashing the tool or leaking adjacent heap memory through the volume-parsing output. Any default build of Dislocker at or below 0.7.3 that opens the malicious image is affected, which is of practical concern mainly to forensic, incident-response, and disk-recovery workflows that routinely process untrusted BitLocker volumes. Exploitation is local and requires the victim to actually open or mount the crafted image (UI:P), and no public exploit code has been identified at time of analysis; an upstream fix commit is available. This is a genuinely Medium-severity, lower-priority issue rather than an urgent one, and it is not noted as confirmed actively exploited (CISA KEV).