bwoodsend rockhopper up to 0.1.2 Binary Parser ragged_array.c count_rows raw buffer overflow

Summaryinfo

A vulnerability was found in bwoodsend rockhopper up to 0.1.2 and classified as critical. This affects the function count_rows of the file rockhopper/src/ragged_array.c of the component Binary Parser. Such manipulation of the argument raw leads to buffer overflow. This vulnerability is uniquely identified as CVE-2022-4969. Local access is required to approach this attack. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in bwoodsend rockhopper up to 0.1.2. Affected by this issue is the function count_rows of the file rockhopper/src/ragged_array.c of the component Binary Parser. The manipulation of the argument raw with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is confidentiality, integrity, and availability.

The weakness was disclosed 05/22/2022 as 1a15fad5e06ae693eb9b8908363d2c8ef455104e. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2022-4969. The exploitation is known to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 0.2.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 1a15fad5e06ae693eb9b8908363d2c8ef455104e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version. A possible mitigation has been published immediately after the disclosure of the vulnerability. The advisory contains the following remark:

When parsing binary data with ldtype=np.uint64, if a length is sufficiently close to 2^64 that it causes the parsing buffer pointer (starting from &buffer) to overflow, then arbitrary memory owned by the current process and whose address is < &buffer can be read. Should the overflow map the pointer to a location not owned by the current process, a segfault will occur.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• bwoodsend

Name

• rockhopper

Version

• 0.1.0
• 0.1.1
• 0.1.2

License

• open-source

Website

• Product: https://github.com/bwoodsend/rockhopper/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion