PT-2024-24368 · C-Blosc2 · C-Blosc2

Alkaidlx · Published 2024-04-02 · Updated 2025-04-25 · CVE-2024-3203

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions c-blosc2 versions up to 2.13.2

Description A critical issue was found in the ndlz8 decompress function of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz8x8.c. This issue leads to a heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations For versions up to 2.13.2, upgrade to version 2.14.3 to address this issue. As a temporary workaround, consider disabling the ndlz8 decompress function until a patch is available. Restrict access to the affected file /src/c-blosc2/plugins/codecs/ndlz/ndlz8x8.c to minimize the risk of exploitation.

Exploit

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2024-3203

OPENSUSE-SU-2024:13910-1

Affected Products

C-Blosc2

References · 16

• 🔥 https://drive.google.com/drive/folders/1T1k3UeS09m65LjVXExUuZfedNQPWQWCo?usp=sharing · Exploit
• 🔥 https://vuldb.com/?submit.304556 · Exploit
• https://github.com/Blosc/c-blosc2/releases/tag/v2.14.3 · Patch
• https://security-tracker.debian.org/tracker/CVE-2024-3203 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-3203 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-3203 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-3203 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3203 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-3203 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-3203 · Vendor Advisory
• https://vuldb.com/?ctiid.259050 · Note
• https://vuldb.com/?id.259050 · Note
• https://t.me/cvenotify/75918 · Telegram Post
• https://t.me/cvenotify/119798 · Telegram Post
• https://twitter.com/CVEnew/status/1775287359585833112 · Twitter Post