CVE-2023-28507CWE-400

Memory exhaustion in LZ4 decompression in UniRPC daemon

Critical · published March 29, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
60.0
In the wild
Unconfirmed
What it is

🔥 A memory-exhaustion issue in Rocket Software UniData and UniVerse could have your system crying uncle! Think of it like a bathtub with a leaky faucet; if the water keeps running, eventually the tub overflows, causing chaos everywhere. In this case, the decompression routine keeps guzzling memory until your system is completely overwhelmed! An attacker could trigger this memory exhaustion, leading to a complete system crash. This could result in downtime and service disruptions, leaving users stranded or unable to access critical applications. The consequences could be absolutely devastating for operations reliant on these systems, and recovery could take time!

Put simply

Think of it like a bathtub with a leaky faucet; if the water keeps running, eventually the tub overflows, causing chaos everywhere. In this case, the decompression routine keeps guzzling memory until your system is completely overwhelmed! This vulnerability allows the decompression routine in UniData and UniVerse versions prior to the specified builds to allocate increasing amounts of memory indefinitely, leading to a crash of the forked process as system memory is exhausted.

What to do

An attacker could trigger this memory exhaustion, leading to a complete system crash. This could result in downtime and service disruptions, leaving users stranded or unable to access critical applications. The consequences could be absolutely devastating for operations reliant on these systems, and recovery could take time! To remediate this, upgrade UniData to version 8.2.4 build 3003 or UniVerse to either 11.3.5 build 1001 or 12.2.1 build 2002. It's critical to prioritize these updates to protect your environment from potential crashes! You've got this! Patch those systems ASAP and you'll have them running smoothly again! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00923 · 60.0th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2023-03-29T20:15Z
EPSS history
Timeline
  • 29 MAR 20:15Z
    Memory exhaustion in LZ4 decompression in UniRPC daemon
    cvelistv5