PT-2023-21866 · Snappier · Snappier
Brantburnett
·
Published
2023-03-27
·
Updated
2023-04-03
·
CVE-2023-28638
CVSS v3.1
7.0
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
Snappier version 1.1.0
Description
This is a buffer overrun vulnerability that can affect any user of Snappier 1.1.0. The issue arises from the use of byte references rather than pointers to pinned buffers, which can lead to invalid buffer range checks during garbage collector compaction. An attacker would need to trigger a repetitive bulk attack with the hope that a GC compaction occurs at precisely the right moment during one of the requests. However, one of the range checks with this problem is a check based on input data in the decompression buffer, meaning malformed input data could be used to increase the chance of success. The most likely result of an attack is a denial of service.
Recommendations
For Snappier version 1.1.0, upgrade to release 1.1.1 to patch the vulnerability.
As a temporary workaround for users unable to upgrade, pin buffers to a fixed location before using them for compression or decompression to mitigate some, but not all, of these cases. Note that at least one temporary decompression buffer is internal to the library and never pinned.
Exploit
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Snappier