USC iLab Cereal up to 1.3.0 Cache std::shared_ptr Variable release of reference

Summaryinfo

A vulnerability was found in USC iLab Cereal up to 1.3.0. It has been classified as very critical. Affected is the function std::shared_ptr of the component Cache Handler. This manipulation as part of Variable causes release of reference. This vulnerability is tracked as CVE-2020-11105. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in USC iLab Cereal up to 1.3.0 and classified as very critical. Affected by this vulnerability is the function std::shared_ptr of the component Cache Handler. The manipulation as part of a Variable leads to a release of reference vulnerability. The CWE definition for the vulnerability is CWE-763. The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in USC iLab cereal through 1.3.0. It employs caching of std::shared_ptr values, using the raw pointer address as a unique identifier. This becomes problematic if an std::shared_ptr variable goes out of scope and is freed, and a new std::shared_ptr is allocated at the same address. Serialization fidelity thereby becomes dependent upon memory layout. In short, serialized std::shared_ptr variables cannot always be expected to serialize back into their original values. This can have any number of consequences, depending on the context within which this manifests.

The weakness was disclosed 03/30/2020. This vulnerability is known as CVE-2020-11105 since 03/30/2020. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/31/2020).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-152436 is pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• USC

Name

• iLab Cereal

Version

• 1.0
• 1.1
• 1.2
• 1.3.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion