Out-of-Bounds Read Vulnerability in libbsd: CVE-2019-20367
Summary
ALPINE-CVE-2019-20367: nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab). Affects libbsd versions < 0.9.1-r1. Fixed in 0.9.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libbsd is a library that provides a collection of functions from BSD systems for use in user-space applications. It is designed to be lightweight and portable, offering functionalities such as memory management, string manipulation, and networking. However, an identified vulnerability (CVE-2019-20367) exposes libbsd to potential out-of-bounds read issues, which can lead to information disclosure or application crashes.
Vulnerability Detail
The vulnerability arises from an out-of-bounds read in the nlist.c file of libbsd versions prior to 0.10.0. During a comparison for a symbol name from the string table (strtab), the code does not properly validate the bounds of the data being accessed. This flaw can be exploited by an attacker to read memory locations beyond the intended buffer, potentially leading to sensitive information disclosure or application instability. The CVSS score for this vulnerability is 9.1, indicating a high severity level.
How To Fix
Minimum fixed version
0.9.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade libbsdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation and sanitization in your application to mitigate the risk of out-of-bounds reads. Additionally, avoid using vulnerable versions of libbsd until an update can be applied.
Conclusion
The CVE-2019-20367 vulnerability in libbsd poses significant risks due to its potential for out-of-bounds reads. It is crucial for users of affected versions to update to the patched releases to ensure the security and stability of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libbsd →
FAQ
CVE-2019-20367 is a vulnerability in libbsd that allows for an out-of-bounds read, potentially leading to information disclosure.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential information disclosure and application crashes due to improper memory access.
Use the command apk add libbsd@<version> in your terminal, replacing <version> with the appropriate patched version number.
Yes, implementing input validation and avoiding the use of vulnerable versions can help mitigate risks until a patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for libbsd.
