Conversion Error Vulnerability in Base Package: fromIntegral Coercion Issues
Summary
HSEC-2024-0006: fromIntegral: conversion error. Affects base versions >= 4.15.0.0, < 4.15.1.0. Fixed in 4.15.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'base' package is a fundamental library in Haskell, providing essential functionalities and data types for Haskell programs. It serves as the backbone for many applications, offering core features such as basic data manipulation, input/output operations, and more. However, the package is susceptible to a specific vulnerability related to the 'fromIntegral' function, which can lead to coercion errors under certain optimization flags.
Vulnerability Detail
The vulnerability arises from the 'fromIntegral' function, which can produce coercion errors when converting negative 'Int' values to 'Natural' or when converting large 'Integer' values greater than 2^64 to 'Natural'. These coercion errors do not trigger arithmetic underflow or overflow errors, leading to potential availability and data integrity issues. In some cases, these errors could escalate to more severe security flaws, such as buffer overflow conditions, posing a risk to the application’s stability and security.
How To Fix
Minimum fixed version
4.15.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'fromIntegral' function for converting negative 'Int' values to 'Natural' or large 'Integer' values to 'Natural'. Instead, implement manual checks to ensure that values are within the acceptable range before conversion. For example:
if x >= 0 then Just (fromIntegral x) else Nothing
This ensures that only valid values are converted, preventing coercion errors.
Conclusion
The 'fromIntegral' conversion error vulnerability in the 'base' package poses significant risks, including data integrity and potential security flaws. It is crucial to update to the patched version 4.15.1.0 or later to mitigate these risks. Implementing manual checks can serve as a temporary workaround until an update can be applied.
See every vulnerability recorded for base →
FAQ
'fromIntegral' is a Haskell function used to convert between different numeric types. However, it can lead to coercion errors under certain conditions.
The impacts include data integrity issues, availability problems, and in some cases, severe security flaws like buffer overflows.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, the vulnerability has been patched in version 4.15.1.0 of the 'base' package. It is recommended to update to this version or later.
If an immediate update is not possible, implement manual checks to validate values before using 'fromIntegral' to prevent coercion errors.
Related vulnerabilities
Recent vulnerabilities recorded for base.
