AIKIDO-2024-10494
ruzstd is vulnerable to Out-of-bounds Read
80
High Risk
This Affects:
ruzstdTL;DR
Affected versions of ruzstd miscalculate the length of the allocated and initialized section of its internal RingBuffer, leading to uninitialized or out-of-bounds reads in the copy_bytes_overshooting function. This vulnerability allows up to 15 bytes of uninitialized memory to be read and potentially written into the output when decompressing a specially crafted archive. If exploited, this issue may result in sensitive memory contents being included in the decompressed data. This leakage can occur multiple times during the processing of a single archive, increasing the potential exposure of confidential information.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ruzstd is vulnerable to Out-of-bounds Read in versions 0.7.0 - 0.7.2.
How to fix this
Upgrade the ruzstd library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant