Cap'n Proto 1.0/1.0.1 KJ HTTP Library buffer underflow

Summaryinfo

A vulnerability was found in Cap'n Proto 1.0/1.0.1. It has been rated as problematic. This issue affects some unknown processing of the component KJ HTTP Library. Performing a manipulation results in buffer underflow. This vulnerability is identified as CVE-2023-48230. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Cap'n Proto 1.0/1.0.1. It has been classified as problematic. This affects an unknown function of the component KJ HTTP Library. The manipulation with an unknown input leads to a buffer underflow vulnerability. CWE is classifying the issue as CWE-124. The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer. This is going to have an impact on availability. The summary by CVE is:

Cap'n Proto is a data interchange format and capability-based RPC system. In versions 1.0 and 1.0.1, when using the KJ HTTP library with WebSocket compression enabled, a buffer underrun can be caused by a remote peer. The underrun always writes a constant value that is not attacker-controlled, likely resulting in a crash, enabling a remote denial-of-service attack. Most Cap'n Proto and KJ users are unlikely to have this functionality enabled and so unlikely to be affected. Maintainers suspect only the Cloudflare Workers Runtime is affected. If KJ HTTP is used with WebSocket compression enabled, a malicious peer may be able to cause a buffer underrun on a heap-allocated buffer. KJ HTTP is an optional library bundled with Cap'n Proto, but is not directly used by Cap'n Proto. WebSocket compression is disabled by default. It must be enabled via a setting passed to the KJ HTTP library via `HttpClientSettings` or `HttpServerSettings`. The bytes written out-of-bounds are always a specific constant 4-byte string `{ 0x00, 0x00, 0xFF, 0xFF }`. Because this string is not controlled by the attacker, maintainers believe it is unlikely that remote code execution is possible. However, it cannot be ruled out. This functionality first appeared in Cap'n Proto 1.0. Previous versions are not affected. This issue is fixed in Cap'n Proto 1.0.1.1.

The weakness was released 11/21/2023. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2023-48230 since 11/13/2023. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.0.1.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Cap'n Proto

Version

• 1.0
• 1.0.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion