Critical · published June 2, 2021
⚠️ An ill-crafted file could lead to chaos! Submitting a specially tailored file to an app using lz4 can cause an integer overflow, leading to out-of-bounds writes and potential crashes. 🔥 Think of this vulnerability as a restaurant where a chef miscalculates the amount of ingredients needed, causing an overflow in the pot — too much leads to an unmanageable mess spilling over the edges! An attacker could exploit this to crash the application, disrupting service availability. While the primary danger is availability, there’s also a potential risk of exposing sensitive data or altering it unexpectedly — a recipe for disaster!
Think of this vulnerability as a restaurant where a chef miscalculates the amount of ingredients needed, causing an overflow in the pot — too much leads to an unmanageable mess spilling over the edges! This flaw in lz4 occurs due to an integer overflow when processing crafted files, allowing the memmove() function to act on a negatively sized argument, potentially leading to memory corruption.
An attacker could exploit this to crash the application, disrupting service availability. While the primary danger is availability, there’s also a potential risk of exposing sensitive data or altering it unexpectedly — a recipe for disaster! To mitigate this issue, ensure you're using the latest version of lz4 where this vulnerability is patched. Review your file handling processes to validate input thoroughly and consider implementing additional memory safety checks to minimize risks. You’ve got the power to tackle this! Follow these steps, and you’ll keep your application safe and sound! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| lz4_project/lz4 | ≥ 1.8.3, < 1.9.4 | 1.9.4 |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/cloud_backup | all versions | — |
| netapp/ontap_select_deploy_administration_utility | all versions | — |
| oracle/communications_cloud_native_core_policy | all versions | — |
| oracle/zfs_storage_appliance_kit | all versions | — |
| splunk/universal_forwarder | ≥ 8.2.0, < 8.2.12 | 8.2.12 |
| splunk/universal_forwarder | ≥ 9.0.0, < 9.0.6 | 9.0.6 |
| splunk/universal_forwarder | all versions | — |