The Curse of the Ncurses

Security researcher JBO presents a deep technical vulnerability research case study in "The Curse of the Ncurses," detailing multiple memory corruption vulnerabilities discovered during a code audit of GNU ncurses and the terminfo terminal capabilities database.

[09:19] JBO explains the historical complexity and stack-based virtual machine architecture of ncurses terminfo string parsing. Terminfo files define terminal capabilities using a specialized bytecode language with an internal evaluation stack [18:07], allowing terminal drivers to push parameters, manipulate strings, and calculate dynamic offsets.

[26:51] The talk explores the attack surface of flawed format string and parameter expansion logic in ncurses capabilities (such as %p, %d, %s, and %v specifiers [35:59]). JBO demonstrates how crafted terminfo descriptions can trigger out-of-bounds stack reads, heap overflows, and memory corruption, highlighting how unprivileged local attackers can exploit vulnerable terminal libraries to target setuid binaries and terminal emulators.

(AI summary — Gemini Flash)