Vulnerability in lz4: Fix LZ4_decompress_safe_partial Read Out of Bound
Summary
GSD-2022-1002173: lz4: fix LZ4_decompress_safe_partial read out of bound. Affects Kernel versions < 73953dfa9d50e5c9fe98ee13fd1d3427aa12a0a3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lz4 package is a compression library that provides fast compression and decompression functions. It is commonly used in various applications and systems to reduce the size of data for storage or transmission. However, a vulnerability has been discovered in the LZ4_decompress_safe_partial function, which could lead to a read out of bound issue. This vulnerability could potentially be exploited by an attacker to access sensitive information or execute arbitrary code.
Vulnerability Detail
The vulnerability in lz4 arises from a read out of bound issue in the LZ4_decompress_safe_partial function. When processing compressed data, the function fails to properly validate the input, allowing an attacker to provide malicious input that can trigger a read operation beyond the bounds of the input buffer. This can result in the disclosure of sensitive information or the execution of arbitrary code, depending on the context in which the lz4 library is used. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the lz4 package is vulnerable to a read out of bound issue in the LZ4_decompress_safe_partial function. This vulnerability can potentially be exploited to access sensitive information or execute arbitrary code. It is recommended to update the Linux Kernel to version v5.4.189 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
lz4 is a compression library that provides fast compression and decompression functions.
This vulnerability could potentially allow an attacker to access sensitive information or execute arbitrary code.
To fix this vulnerability, update the Linux Kernel to version v5.4.189 or later.
No workaround has been provided for this vulnerability.
For more details, please refer to the vulnerability report at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002173.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
