CVE-2021-21401: Nanopb Protocol Buffers Implementation Free/Realloc Invalid Calls
Summary
CVE-2021-21401: Nanopb is a small code-size Protocol Buffers implementation in ansi C. Affects nanopb across 3 version ranges.
< 0.3.9.8
>= 0.4.0, < 0.4.5
< e2f0ccf939d9f82931d085acb6df8e9a182a4261
Fixed in 0.3.9.8 or 0.4.5, depending on the release line you run. How to fix ↓
Also tracked for
- nanopb · Debian:11
The same CVE-2021-21401 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nanopb is a small code-size Protocol Buffers implementation in ANSI C. It is designed to be lightweight and efficient, making it suitable for resource-constrained environments. Protocol Buffers is a language-agnostic data serialization format developed by Google. Nanopb allows developers to encode and decode Protocol Buffers messages in their C applications. It is commonly used in embedded systems and IoT devices.
Vulnerability Detail
The vulnerability (CVE-2021-21401) in Nanopb versions before 0.3.9.8 and 0.4.5 arises when decoding a specifically formed message that contains an oneof field. If the oneof field directly contains both a pointer field and a non-pointer field, and the message data first contains the non-pointer field and then the pointer field, it can lead to invalid free() or realloc() calls. This occurs because the data of the non-pointer field is incorrectly treated as a pointer value. While this type of message data is rare in normal messages, it becomes a concern when parsing untrusted data. The vulnerability can potentially be exploited to cause memory corruption or crashes in applications that use Nanopb for Protocol Buffers decoding.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.3.9.80.3.9.8pip install --upgrade "nanopb==0.3.9.8" -
>= 0.4.0, < 0.4.50.4.5pip install --upgrade "nanopb==0.4.5"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by ensuring that untrusted data is properly validated and sanitized before being parsed by Nanopb. Additionally, implementing input validation and bounds checking can help prevent potential exploitation of the vulnerability.
Conclusion
The vulnerability in Nanopb versions before 0.3.9.8 and 0.4.5 can lead to invalid free() or realloc() calls when decoding specially crafted messages. It is recommended to update to the fixed versions to mitigate the risk of memory corruption or crashes. Developers should also ensure proper validation and sanitization of untrusted data to prevent potential exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nanopb →
FAQ
Nanopb is a small code-size Protocol Buffers implementation in ANSI C. It allows developers to encode and decode Protocol Buffers messages in their C applications.
The vulnerability can lead to invalid free() or realloc() calls, potentially causing memory corruption or crashes in applications that use Nanopb for Protocol Buffers decoding.
To fix the vulnerability, update your Nanopb version to 0.3.9.8 or 0.4.5. These versions include the necessary fixes to prevent the invalid calls.
While there is no specific workaround mentioned, you can mitigate the risk by validating and sanitizing untrusted data before parsing it with Nanopb. Implementing input validation and bounds checking can also help prevent exploitation.
For more information, you can refer to the GitHub Security Advisory (https://github.com/pypa/advisory-database/blob/main/vulns/nanopb/PYSEC-2021-432.yaml) or the CVE entry (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21401).
Related vulnerabilities
Recent vulnerabilities recorded for nanopb.
