PT-2020-18331 · Nanopb · Nanopb
Published
2020-02-04
·
Updated
2024-06-15
·
CVE-2020-5235
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Nanopb versions prior to 0.4.1
Nanopb versions prior to 0.3.9.5
Nanopb versions prior to 0.2.9.4
Description
There is a potentially exploitable out of memory condition in Nanopb. When Nanopb is compiled with PB ENABLE MALLOC, the message to be decoded contains a repeated string, bytes or message field and realloc() runs out of memory when expanding the array. Nanopb can end up calling
free() on a pointer value that comes from uninitialized memory. Depending on the platform, this can result in a crash or further memory corruption, which may be exploitable in some cases.Recommendations
For versions prior to 0.4.1, update to nanopb-0.4.1 to fix the issue.
For versions prior to 0.3.9.5, update to nanopb-0.3.9.5 to fix the issue.
For versions prior to 0.2.9.4, update to nanopb-0.2.9.4 to fix the issue.
As a temporary workaround, consider disabling the PB ENABLE MALLOC compilation option until a patch is available.
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nanopb