PT-2022-14017 · Apple · Swift

Gliush + 2 · Published 2022-06-16 · Updated 2023-06-07 · CVE-2022-1642

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Swift versions prior to 5.6.2 for Linux and Windows

Description A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This issue is caused by the interaction between the Swift standard library's Codable protocol and the JSONDecoder class. When a type that adopts Codable requests the initialization of a field with an integer value, the JSONDecoder class uses a type-erased container with different accessor methods to attempt and coerce a corresponding JSON value and produce an integer. In the case the JSON value was a numeric literal with a floating-point portion, JSONDecoder used different type-eraser methods during validation than it did during the final casting of the value, producing a deterministic crash due to this mismatch. The JSONDecoder class is often wrapped by popular Swift-based web frameworks to parse the body of HTTP requests and perform basic type validation, making the attack low-effort. The attack does not have any confidentiality or integrity risks in and of itself, but unexpected crashes can lead to violations of invariants in services, potentially escalating the risk.

Recommendations To resolve the issue, update to Swift 5.6.2 for Linux and Windows, then recompile and redeploy the software. The new version of Swift includes an updated swift-corelibs-foundation package. As a temporary workaround, consider using JSON parsing directly, such as through the JSONSerialization class, rather than using the JSONDecoder class. Alternatively, ensure that fields intended to initialize Swift integer types use a JSON numeric constant without a fractional part to avoid the crash.

Fix

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

CWE-351

CWE-241

Related Identifiers

CVE-2022-1642

GHSA-239C-6CV2-WWX8

Affected Products

Swift

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-1642 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1642 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-239c-6cv2-wwx8 · Vendor Advisory
• https://github.com/apple/swift-corelibs-foundation/security/advisories/GHSA-239c-6cv2-wwx8 · Note
• https://github.com/apple/swift-corelibs-foundation/commit/b541491f73b39007a38f3ff5a0cbe89d09ef1614 · Note
• https://github.com/apple/swift-corelibs-foundation · Note
• https://t.me/cibsecurity/44661 · Telegram Post
• https://t.me/cvenotify/32635 · Telegram Post