Vulnerability in lz4 package: Out-of-Bound Read in LZ4_decompress_safe_partial
Summary
GSD-2022-1001350: lz4: fix LZ4_decompress_safe_partial read out of bound. Affects Kernel versions < e64dbe97c05c769525cbca099ddbd22485630235. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lz4 package is a compression library that provides fast compression and decompression algorithms. It is commonly used in various applications and systems to reduce data size and improve performance. However, a vulnerability has been discovered in the LZ4_decompress_safe_partial function, which can lead to out-of-bound reads. This vulnerability can potentially be exploited by an attacker to read sensitive information or cause a denial-of-service condition.
Vulnerability Detail
The vulnerability in the lz4 package arises from a flaw in the LZ4_decompress_safe_partial function. When decompressing compressed data, the function fails to properly validate the input, leading to out-of-bound reads. An attacker can craft a malicious compressed file that triggers this vulnerability, potentially resulting in the disclosure of sensitive information or a crash of the application or system. This vulnerability has been assigned the ID GSD-2022-1001350 and has been fixed in Linux Kernel version v5.16.20.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the lz4 package is not immediately feasible, a possible workaround is to disable or restrict the usage of the affected functionality. This can be achieved by modifying the application or system configuration to avoid using the LZ4_decompress_safe_partial function or by implementing input validation checks to ensure that only valid compressed data is processed.
Conclusion
In conclusion, the lz4 package is vulnerable to an out-of-bound read issue in the LZ4_decompress_safe_partial function. This vulnerability can potentially be exploited to read sensitive information or cause a denial-of-service condition. It is crucial to update the lz4 package to the latest version, specifically Linux Kernel version v5.16.20 or later, to mitigate the risk. Regularly updating software packages and implementing input validation checks are important security practices. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially allow an attacker to read sensitive information or cause a denial-of-service condition by exploiting the out-of-bound read issue in the LZ4_decompress_safe_partial function.
Yes, this vulnerability has been fixed in Linux Kernel version v5.16.20. It is recommended to update to this version or later to mitigate the risk.
The specific vulnerability described in GSD-2022-1001350 affects versions of the lz4 package prior to the fix in Linux Kernel version v5.16.20. It is important to check the version of the package installed and update if necessary.
Exploiting this vulnerability typically requires the attacker to have access to the system or application processing the compressed data. However, if the affected functionality is exposed to untrusted inputs, remote exploitation may be possible.
You can use vulnerability monitoring tools like Vulert to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software. You can try the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
