CVE-2020-8927: Brotli Library Buffer Overflow in Bitnami dotnet-sdk

Background

The Bitnami dotnet-sdk is a software development kit (SDK) that provides tools and libraries for developing .NET applications. It includes the Brotli library, which is used for data compression and decompression. Brotli is vulnerable to a buffer overflow issue in versions prior to 1.0.8. This vulnerability allows an attacker to trigger a crash by controlling the input length of a "one-shot" decompression request to a script. The crash occurs when copying over chunks of data larger than 2 GiB.

Vulnerability Detail

The buffer overflow vulnerability in the Brotli library can be exploited by an attacker to cause a crash in the dotnet-sdk application. This can lead to a denial-of-service (DoS) condition, impacting the availability of the application. The vulnerability can be triggered by sending a specially crafted input length to a decompression script. To mitigate the risk, it is recommended to update the Brotli library to version 1.0.8 or later. Alternatively, using the "streaming" API instead of the "one-shot" API and imposing chunk size limits can also help mitigate the vulnerability.

Workaround

A possible workaround for this vulnerability is to use the "streaming" API instead of the "one-shot" API and impose chunk size limits. This can be done by modifying the code that interacts with the Brotli library to use the streaming API and set appropriate chunk size limits. Here is an example of how to use the streaming API in C#:

// Create a Brotli decompressor
using (var decompressor = new BrotliStream(input, CompressionMode.Decompress))
{
    // Set the chunk size limit
    decompressor.SetChunkSizeLimit(chunkSizeLimit);

    // Read and process the decompressed data
    byte[] buffer = new byte[bufferSize];
    int bytesRead;
    while ((bytesRead = decompressor.Read(buffer, 0, buffer.Length)) > 0)
    {
        // Process the decompressed data
        ProcessData(buffer, bytesRead);
    }
}

Conclusion

The Brotli library in the Bitnami dotnet-sdk is vulnerable to a buffer overflow issue. To mitigate the risk, it is recommended to update the Brotli library to version 1.0.8 or later. Alternatively, using the "streaming" API instead of the "one-shot" API and imposing chunk size limits can help mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for dotnet-sdk →

FAQ

// Create a Brotli decompressor
using (var decompressor = new BrotliStream(input, CompressionMode.Decompress))
{
    // Set the chunk size limit
    decompressor.SetChunkSizeLimit(chunkSizeLimit);

    // Read and process the decompressed data
    byte[] buffer = new byte[bufferSize];
    int bytesRead;
    while ((bytesRead = decompressor.Read(buffer, 0, buffer.Length)) > 0)
    {
        // Process the decompressed data
        ProcessData(buffer, bytesRead);
    }
}