Attack Chain

1. The attacker gains local access to a system running Prime95 29.4b8.
2. The attacker modifies the PrimeNet connection settings within Prime95.
3. The attacker supplies a malicious payload within the optional “proxy hostname” field, exceeding the expected buffer size.
4. When Prime95 attempts to process the overly long proxy hostname, a buffer overflow occurs.
5. The overflow overwrites the Structured Exception Handling (SEH) record on the stack.
6. When an exception occurs within Prime95 (triggered intentionally or unintentionally), the overwritten SEH record points to attacker-controlled code.
7. The system attempts to handle the exception, causing execution to jump to the attacker-controlled code injected via the proxy hostname.
8. The attacker’s code executes with the privileges of the Prime95 process, potentially leading to system compromise.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected system. This can lead to complete system compromise, data theft, or installation of malware. Since the vulnerability is local, an attacker needs prior access to the system, either through social engineering, stolen credentials, or other means. However, once access is obtained, exploitation is relatively straightforward. This vulnerability has a high CVSS score of 8.4, reflecting the significant potential impact.

Recommendation

• Upgrade to a patched version of Prime95 that addresses CVE-2018-25299. Check the vendor’s website (https://www.mersenne.org/download/#download) for updates.
• Implement strong input validation on any configuration files or settings that Prime95 reads to prevent buffer overflows.
• Monitor process creation events for unusual activity originating from the Prime95 executable, which could indicate exploitation. Deploy the Sigma rule provided to detect suspicious command line arguments.