PT-2023-2318 · Deno · Deno

Lucacasonato · Published 2023-03-23 · Updated 2023-03-31 · CVE-2023-28445

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Deno version 1.32.0

Description The issue is related to resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation, which could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild. Deno Deploy users are not affected.

Recommendations For Deno version 1.32.0, upgrade to Deno 1.32.1 to resolve the issue. As a temporary workaround for Deno version 1.32.0, run with --v8-flags=--no-harmony-rab-gsab to disable resizable ArrayBuffers.

Exploit

Fix

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

BDU:2023-02082

CVE-2023-28445

GHSA-C25X-CM9X-QQGX

Affected Products

Deno

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28445.json · Exploit
• https://github.com/denoland/deno/releases/tag/v1.32.1 · Patch
• https://github.com/denoland/deno/pull/18395 · Vendor Advisory
• https://github.com/denoland/deno/security/advisories/GHSA-c25x-cm9x-qqgx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28445 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28445 · Security Note
• https://osv.dev/vulnerability/GHSA-c25x-cm9x-qqgx · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02082 · Security Note
• https://github.com/denoland/deno · Note
• https://github.com/denoland/deno/pull/18452 · Note
• https://t.me/pentestingnews/34368 · Telegram Post
• https://t.me/cvenotify/47235 · Telegram Post
• https://t.me/cibsecurity/60637 · Telegram Post