PT-2024-22149 · Deno · Deno

Mmastrac · Published 2024-03-05 · Updated 2025-01-03 · CVE-2024-27935

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Deno versions 1.35.1 through 1.36.2

Description A vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. This issue arises from the re-use of a global buffer (BUF) in stream wrap.ts used as a performance optimization to limit allocations during these asynchronous read operations. The vulnerability can lead to data intended for one session being received by another session, potentially resulting in data corruption and unexpected behavior. This affects all users of Deno that use the node.js compatibility layer for network communication or other streams, including packages that may require node.js libraries indirectly.

Recommendations For Deno versions 1.35.1 through 1.36.2, update to version 1.36.3 or later to resolve the issue. As a temporary workaround, consider disabling the use of Node.js streams sourced from sockets or files until a patch is applied. Restrict access to the stream wrap.ts module to minimize the risk of exploitation. Avoid using the net.Stream API connected to remote servers such as databases or key/value stores until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-488

Related Identifiers

CVE-2024-27935

GHSA-WRQV-PF6J-MQJP

Affected Products

Deno

References · 9

• 🔥 https://github.com/denoland/deno/issues/20188 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27935.json · Exploit
• https://github.com/denoland/deno/commit/3e9fb8aafd9834ebacd27734cea4310caaf794c6 · Patch
• https://github.com/denoland/deno/security/advisories/GHSA-wrqv-pf6j-mqjp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27935 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27935 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wrqv-pf6j-mqjp · Vendor Advisory
• https://github.com/denoland/deno · Note
• https://twitter.com/cracbot/status/1771321522793128442 · Twitter Post