Apache Arrow 0.14.0/0.14.1 Array Null Value null pointer dereference

Summaryinfo

A vulnerability, which was classified as problematic, was found in Apache Arrow 0.14.0/0.14.1. This affects an unknown function of the component Array Handler. Executing a manipulation as part of Null Value can lead to null pointer dereference. This vulnerability is tracked as CVE-2019-12408. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical was found in Apache Arrow 0.14.0/0.14.1. This vulnerability affects some unknown functionality of the component Array Handler. The manipulation as part of a Null Value leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. CVE summarizes:

It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.

The weakness was disclosed 11/08/2019 (Website). The advisory is shared for download at lists.apache.org. This vulnerability was named CVE-2019-12408 since 05/28/2019. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/09/2019).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-145253 is pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Apache

Name

• Arrow

Version

• 0.14.0
• 0.14.1

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion