Memory Corruption Vulnerability in bsdiff Package: CVE-2020-14315
Summary
DEBIAN-CVE-2020-14315: A memory corruption vulnerability is present in bspatch as shipped in Colin Percival’s bsdiff tools version 4.3. Affects bsdiff versions < 4.3-22. Fixed in 4.3-22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bsdiff package is a tool used for creating and applying binary patches. It is widely utilized in software development for efficient updates and modifications to binary files. The package is known for its ability to generate small patch files that can be applied to existing binaries, making it a popular choice among developers. However, it has been identified to have a memory corruption vulnerability that can be exploited if not addressed.
Vulnerability Detail
A memory corruption vulnerability exists in the bspatch function of the bsdiff tools version 4.3, developed by Colin Percival. This vulnerability arises from insufficient checks when handling external inputs, allowing an attacker to bypass sanity checks and write beyond the boundaries of dynamically allocated buffers. This could lead to arbitrary code execution or crashes, posing significant security risks to systems using the affected package.
How To Fix
Minimum fixed version
4.3-22
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bsdiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of the bsdiff tool by restricting its use to trusted inputs and avoiding the processing of untrusted or external data until the package is updated.
Conclusion
The bsdiff package has a critical memory corruption vulnerability (CVE-2020-14315) that needs immediate attention. Users are advised to update to the patched version to mitigate potential security risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for bsdiff →
FAQ
CVE-2020-14315 is a memory corruption vulnerability found in the bsdiff package, which can lead to security risks if exploited.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to arbitrary code execution or crashes, compromising the security and stability of affected systems.
Yes, the patched version of the bsdiff package is 4.3-22. Updating to this version will resolve the vulnerability.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for bsdiff.
