Node.js up to 10.8.x Buffer.alloc encoding memory corruption

Summaryinfo

A vulnerability categorized as problematic has been discovered in Node.js up to 10.8.x. Affected by this issue is the function Buffer.alloc. Executing a manipulation of the argument encoding as part of Argument can lead to memory corruption. The identification of this vulnerability is CVE-2018-7166. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Node.js up to 10.8.x (JavaScript Library) and classified as problematic. This vulnerability affects the function Buffer.alloc. The manipulation of the argument encoding as part of a Argument leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality. CVE summarizes:

In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal "fill" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information.

The bug was discovered 08/16/2018. The weakness was shared 08/21/2018 (Website). The advisory is shared for download at nodejs.org. This vulnerability was named CVE-2018-7166 since 02/14/2018. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 5 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 112128 (FreeBSD : node.js -- multiple vulnerabilities (0904e81f-a89d-11e8-afbb-bc5ff4f77b71)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family FreeBSD Local Security Checks and running in the context l.

Upgrading to version 10.9.0 eliminates this vulnerability. A possible mitigation has been published 5 days after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (112128). The entry VDB-123102 is related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• JavaScript Library

Name

• Node.js

Version

• 10.0
• 10.1
• 10.2
• 10.3
• 10.4
• 10.5
• 10.6
• 10.7
• 10.8

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion