Out-of-Bounds Read Vulnerability in File Package: CVE-2019-8906
Summary
ALPINE-CVE-2019-8906: do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused. Affects file versions < 5.36-r0. Fixed in 5.36-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'file' package is a widely used utility in various operating systems, including Alpine Linux, that identifies file types based on their content. It plays a crucial role in file management and security by allowing users to determine the nature of files without relying solely on file extensions. However, certain versions of this package are vulnerable to an out-of-bounds read issue, which can lead to potential security risks.
Vulnerability Detail
The vulnerability identified as CVE-2019-8906 originates from a flaw in the 'do_core_note' function within the 'readelf.c' file of the 'file' package version 5.35. This flaw is caused by improper use of the 'memcpy' function, leading to an out-of-bounds read. If exploited, this vulnerability could allow an attacker to read sensitive information from memory, potentially compromising the integrity and confidentiality of the system. The CVSS score for this vulnerability is 4.4, indicating a moderate severity level.
How To Fix
Minimum fixed version
5.36-r0
This is the first release that contains the fix.
sudo apk add --upgrade fileTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the affected functionality of the 'file' package until you can apply the patch. However, it is highly recommended to update to the patched version as soon as possible.
Conclusion
The CVE-2019-8906 vulnerability in the 'file' package poses a moderate security risk due to an out-of-bounds read issue. It is crucial for users of affected versions to update to the patched version 5.36-r0 or later to mitigate potential security threats. Utilizing tools like Vulert can further enhance your security posture by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for file →
FAQ
CVE-2019-8906 is a vulnerability in the 'file' package that allows for an out-of-bounds read due to improper use of the 'memcpy' function.
Versions of the 'file' package prior to 5.36-r0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update the package immediately, refrain from using the affected functionality as a temporary workaround until you can apply the patch.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json. It helps you stay informed about potential security risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for file.
