Out-of-Bounds Read and Segmentation Violation in ncurses
Summary
CVE-2022-29458: ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library. Affects ncurses across 2 version ranges.
< 6.2_p20210109-r1
< deb0d07e8eb4803b9e9653359eab17a30d04369d
Fixed in 6.2_p20210109-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ncurses is a library that provides terminal-independent access to character screens. It is commonly used in Unix-like operating systems to create text-based user interfaces. The library allows developers to control the cursor position, display text in various colors, and handle keyboard input. However, a vulnerability has been discovered in ncurses version 6.3 and earlier that can lead to an out-of-bounds read and segmentation violation.
Vulnerability Detail
The vulnerability, identified as CVE-2022-29458, originates from a flaw in the convert_strings function in the tinfo/read_entry.c file of the terminfo library. Due to improper bounds checking, an attacker can exploit this vulnerability to read data beyond the intended buffer, potentially leading to a segmentation violation. This could result in a denial-of-service condition or even remote code execution if the attacker can control the data being read.
How To Fix
Minimum fixed version
6.2_p20210109-r1
This is the first release that contains the fix.
sudo apk add --upgrade ncursesTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can consider implementing input validation and sanitization in their applications that utilize the ncurses library. By ensuring that user-supplied data is properly validated and restricted within the expected bounds, the risk of triggering the vulnerability can be mitigated.
Conclusion
The vulnerability in ncurses version 6.3 and earlier can lead to an out-of-bounds read and segmentation violation. It is crucial to update to the patched version or apply the recommended workarounds to mitigate the risk. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ncurses →
FAQ
ncurses is a library that provides terminal-independent access to character screens, allowing developers to create text-based user interfaces.
The vulnerability can lead to an out-of-bounds read and segmentation violation, potentially resulting in a denial-of-service condition or remote code execution.
Versions of ncurses prior to 6.3 with patch 20220416 are affected by this vulnerability.
To fix the vulnerability, update the ncurses library to version 6.3 with patch 20220416 or later.
Implementing input validation and sanitization in applications can help mitigate the risk of triggering the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for ncurses.
