AIKIDO-2024-10513
pprof is vulnerable to Denial of Service (DoS)
35
Low Risk
This Affects:
pprofTL;DR
Affected versions of this package misuse the unsafe std::slice::from_raw_parts API, breaking safety assumptions. In TempFdArrayIterator.next, a generic type can create and pass a misaligned pointer. Additionally, using c_void for address validation can expose uninitialized memory. These issues highlight the need for proper type checks before type conversions with unsafe APIs. Exploiting this vulnerability can cause a panic, potentially leading to a Denial of Service (DoS) in applications like greptimedb when using pprof::report::ReportBuilder::build or pprof::validate.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
pprof is vulnerable to Denial of Service (DoS) in versions 0.1.0 - 0.13.0.
How to fix this
Upgrade the pprof library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant