Null Pointer Dereference Vulnerability in Protobuf Package
Summary
CVE-2021-22570: Nullptr dereference when a null char is present in a proto symbol. Affects protobuf across 2 version ranges.
< 3.12.4-1+deb11u1
< ae50d9b9902526efd6c7a1907d09739f959c6297
Fixed in 3.12.4-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Protobuf, or Protocol Buffers, is a language-neutral, platform-neutral extensible mechanism for serializing structured data, developed by Google. It is widely used for data interchange in various applications due to its efficiency and ease of use. However, the package has been found to have a vulnerability that can lead to a null pointer dereference when a null character is present in a proto symbol, which can cause application crashes or unexpected behavior.
Vulnerability Detail
The vulnerability, identified as CVE-2021-22570, arises from the incorrect parsing of a proto symbol containing a null character. This leads to an unchecked call into the proto file's name during the generation of the resulting error message. As a result, the file pointer becomes null, potentially causing a crash or undefined behavior in applications that rely on the Protobuf library. This vulnerability affects multiple versions of the Protobuf package across different Debian ecosystems.
How To Fix
Minimum fixed version
3.12.4-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade protobufTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to avoid using proto symbols that may contain null characters. However, this is not a permanent solution and upgrading is strongly recommended.
Conclusion
The CVE-2021-22570 vulnerability in the Protobuf package poses a risk of application crashes due to null pointer dereference. It is crucial for users to upgrade to version 3.15.0 or greater to mitigate this risk. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your software.
See every vulnerability recorded for protobuf →
FAQ
CVE-2021-22570 is a vulnerability in the Protobuf package that can lead to a null pointer dereference when a null character is present in a proto symbol.
This vulnerability can cause your application to crash or behave unexpectedly if it relies on the Protobuf library for data serialization.
Versions prior to 3.15.0 are affected. Specific Debian versions have been noted, including Debian 11, 12, and 13.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application at the Vulert playground without any signup.
The CVSS score of CVE-2021-22570 is 5.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for protobuf.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.