CVE-2021-4070: Off-by-one Error in v2fly/v2ray-core
Summary
CVE-2021-4070: Off-by-one Error in v2fly/v2ray-core. Affects github.com/v2fly/v2ray-core/v4 versions < 4.44.0. Fixed in 4.44.0. How to fix ↓
Also tracked for
- github.com/v2fly/v2ray-core · Go
- golang-v2ray-core · Debian:11
The same CVE-2021-4070 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
v2fly/v2ray-core is a Go package that provides a platform for building proxy servers. It is widely used for its robustness and flexibility in handling network traffic. However, prior to version 4.44.0, v2fly/v2ray-core is vulnerable to an off-by-one error. This vulnerability arises from incorrect indexing operations on arrays, slices, or strings, where an index equal to or greater than the length of the object is used. As a result, the index can be out of bounds, leading to potential memory corruption or information disclosure.
Vulnerability Detail
The off-by-one error in v2fly/v2ray-core can have severe consequences. By using an index that is equal to or greater than the length of an array, slice, or string, the code can access memory beyond the intended boundaries. This can result in various security issues, such as overwriting critical data, causing crashes, or leaking sensitive information. An attacker who can exploit this vulnerability may be able to execute arbitrary code, escalate privileges, or launch denial-of-service attacks.
How To Fix
Minimum fixed version
4.44.0
This is the first release that contains the fix.
go get github.com/v2fly/v2ray-core/v4@v4.44.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can manually modify the affected code to ensure that indexing operations use an index that is strictly less than the length of the array, slice, or string. Here is an example of how the code can be modified:
def indexOutOfBounds(arr []int, index int) int {
if index >= len(arr) {
return -1 // or handle the error appropriately
}
return arr[index]
}
Conclusion
The off-by-one error in v2fly/v2ray-core prior to version 4.44.0 poses a critical security risk. It can lead to memory corruption, crashes, or information disclosure, potentially allowing attackers to execute arbitrary code or launch denial-of-service attacks. To mitigate this vulnerability, it is essential to update to v2fly/v2ray-core version 4.44.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/v2fly/v2ray-core/v4 →
FAQ
An off-by-one error is a programming mistake where an index or counter is incremented or decremented incorrectly by one, leading to unexpected behavior or vulnerabilities. In this case, the vulnerability arises from using an index equal to or greater than the length of an array, slice, or string.
The consequences of this vulnerability can be severe. It can result in memory corruption, crashes, or information disclosure. An attacker who can exploit this vulnerability may be able to execute arbitrary code, escalate privileges, or launch denial-of-service attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file without requiring access to the code or installation.
Yes, developers can manually modify the affected code to ensure that indexing operations use an index that is strictly less than the length of the array, slice, or string. However, it is strongly recommended to update to v2fly/v2ray-core version 4.44.0 or later to apply the official fix.
Yes, the CVSS score for this vulnerability is 9.1, indicating a critical severity level. It is crucial to address this vulnerability promptly to mitigate potential risks.
