CVE-2020-26243: Memory leak in Nanopb
Summary
CVE-2020-26243: Memory leak in Nanopb. Affects nanopb across 2 version ranges.
>= 0.3.2, < 0.3.9.7
>= 0.4.0, < 0.4.4
Fixed in 0.3.9.7 or 0.4.4, depending on the release line you run. How to fix ↓
Also tracked for
- nanopb · Debian:11
The same CVE-2020-26243 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nanopb is an open-source library that provides a simple way to encode and decode Protocol Buffers data. It is commonly used in Python projects and is available on PyPI. Nanopb allows developers to efficiently serialize and deserialize structured data, making it easier to exchange information between different systems. However, a vulnerability has been discovered in Nanopb that can lead to a memory leak under certain conditions.
Vulnerability Detail
The vulnerability in Nanopb arises when decoding a specially crafted message that contains a oneof field with a static submessage that contains a dynamic field. If the message being decoded contains the submessage multiple times, memory can be leaked when dynamic allocation is enabled. While this scenario is rare in normal messages, it becomes a concern when parsing untrusted data. The memory leak can potentially exhaust system resources and lead to denial-of-service attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.3.2, < 0.3.9.70.3.9.7pip install --upgrade "nanopb==0.3.9.7" -
>= 0.4.0, < 0.4.40.4.4pip install --upgrade "nanopb==0.4.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the patched versions is not immediately feasible, there are a few workarounds available:
- Set the option
no_unionsfor the oneof field. This will generate separate fields instead of a C union, avoiding the problematic code. - Set the type of the submessage field inside the oneof to
FT_POINTER. This will dynamically allocate the entire submessage, bypassing the problematic code. - Use an arena allocator for Nanopb to ensure that all memory can be released afterwards.
Conclusion
The memory leak vulnerability in Nanopb can have serious consequences if exploited by an attacker. It is crucial to update to the patched versions or implement the provided workarounds to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nanopb →
FAQ
Nanopb is an open-source library that provides a simple way to encode and decode Protocol Buffers data. It is commonly used in Python projects for efficient serialization and deserialization of structured data.
The vulnerability can lead to a memory leak when decoding specific messages that contain a oneof field with a static submessage containing a dynamic field. This can be exploited by an attacker to exhaust system resources and potentially launch denial-of-service attacks.
To fix the vulnerability, it is recommended to update to Nanopb versions 0.3.9.7 or 0.4.4 once they are available. These versions include a patch that addresses the memory leak issue.
Yes, if updating to the patched versions is not immediately feasible, there are a few workarounds that can be implemented. These include setting the no_unions option for the oneof field, setting the type of the submessage field to FT_POINTER, or using an arena allocator for Nanopb.
You can find more information about this vulnerability in the bug report on the Nanopb GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for nanopb.
