GHSA-55g7-9cwv-5qfv

Опубликовано: 25 сент. 2023

Источник: github

Github: Прошло ревью

CVSS3: 7.5

Описание

snappy-java's missing upper bound check on chunk length can lead to Denial of Service (DoS) impact

Summary

snappy-java is a data compression library in Java. Its SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too-large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur.

Scope

All versions of snappy-java including the latest released version 1.1.10.3. A fix is applied in 1.1.10.4

Details

While performing mitigation efforts related to CVE-2023-34455 in Confluent products, our Application Security team closely analyzed the fix that was accepted and merged into snappy-java version 1.1.10.1 in this commit. The check on line 421 only attempts to check if chunkSize is not a negative value. We believe that this is an inadequate fix as it misses an upper-bounds check for overly positive values such as 0x7FFFFFFF (or (2,147,483,647 in decimal) before actually attempting to allocate the provided unverified number of bytes via the “chunkSize” variable. This missing upper-bounds check can lead to the applications depending upon snappy-java to allocate an inappropriate number of bytes on the heap which can then cause an java.lang.OutOfMemoryError exception. Under some specific conditions and contexts, this can lead to a Denial-of-Service (DoS) attack with a direct impact on the availability of the dependent implementations based on the usage of the snappy-java library for compression/decompression needs.

PoC

Compile and run the following code:

package org.example; import org.xerial.snappy.SnappyInputStream; import java.io.*; public class Main { public static void main(String[] args) throws IOException { byte[] data = {-126, 'S', 'N', 'A', 'P', 'P', 'Y', 0, 0, 0, 0, 0, 0, 0, 0, 0,(byte) 0x7f, (byte) 0xff, (byte) 0xff, (byte) 0xff}; SnappyInputStream in = new SnappyInputStream(new ByteArrayInputStream(data)); byte[] out = new byte[50]; try { in.read(out); } catch (Exception ignored) { } } }

Impact

Denial of Service of applications dependent on snappy-java especially if ExitOnOutOfMemoryError or CrashOnOutOfMemoryError is configured on the JVM.

Credits

Jan Werner, Mukul Khullar and Bharadwaj Machiraju from Confluent's Application Security team.

We kindly request for a new CVE ID to be assigned once you acknowledge this vulnerability.

Ссылки

Пакеты

Наименование

org.xerial.snappy:snappy-java

maven

Затронутые версииВерсия исправления

<= 1.1.10.3

1.1.10.4

EPSS

Процентиль: 41%

0.0019

Низкий

7.5 High

CVSS3

CVE ID

CVE-2023-43642

Дефекты

CWE-770

Связанные уязвимости

CVE-2023-43642

CVSS3: 7.5

ubuntu

больше 2 лет назад

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.

CVE-2023-43642

CVSS3: 7.5

redhat

больше 2 лет назад

CVE-2023-43642

CVSS3: 7.5

nvd

больше 2 лет назад

CVE-2023-43642

CVSS3: 7.5

debian

больше 2 лет назад

snappy-java is a Java port of the snappy, a fast C++ compresser/decomp ...

BDU:2024-00588

CVSS3: 7.5

fstec

около 2 лет назад

Уязвимость компонента Visual Analyzer (Snappy) программной платформы Oracle Business Intelligence Enterprise Edition, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 41%

0.0019

Низкий

7.5 High

CVSS3

CVE ID

CVE-2023-43642

Дефекты

CWE-770