CVE-2020-26243: Memory Leak in Nanopb Package
Summary
CVE-2020-26243: Memory leak in Nanopb. Affects nanopb across 2 version ranges.
>= 0.3.2, < 0.3.9.7
>= 0.4.0, < 0.4.4
Fixed in 0.3.9.7 or 0.4.4, depending on the release line you run. How to fix ↓
Also tracked for
- nanopb · Debian:11
The same CVE-2020-26243 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nanopb is a small code-size Protocol Buffers implementation in C, designed for use in embedded systems. It allows developers to serialize structured data efficiently, making it suitable for applications where memory and processing power are limited. However, it is vulnerable to a memory leak issue when decoding specific message formats, particularly when dynamic allocation is enabled.
Vulnerability Detail
The vulnerability arises when decoding specially crafted messages that contain a 'oneof' field with a static submessage that includes a dynamic field. If the message being decoded contains this submessage multiple times, it can lead to a memory leak. This issue is particularly concerning when handling untrusted data, as it can result in excessive memory consumption and potential denial of service.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.3.2, < 0.3.9.70.3.9.7pip install --upgrade "nanopb==0.3.9.7" -
>= 0.4.0, < 0.4.40.4.4pip install --upgrade "nanopb==0.4.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
-
0: Set the option 'no_unions' for the oneof field in your Nanopb configuration. This will generate fields as separate entities instead of using C unions, thus avoiding the problematic code.
-
1: Change the type of the submessage field inside the oneof to 'FT_POINTER'. This ensures that the entire submessage is dynamically allocated, preventing the execution of the problematic code.
-
2: Utilize an arena allocator for Nanopb to ensure that all allocated memory can be released properly after use.
Conclusion
The CVE-2020-26243 vulnerability in the Nanopb package poses a significant risk of memory leaks when decoding certain message formats. It is crucial to update to the patched versions or apply the suggested workarounds to protect your applications from potential denial of service attacks.
See every vulnerability recorded for nanopb →
FAQ
CVE-2020-26243 is a vulnerability in the Nanopb package that can lead to memory leaks when decoding specific message formats.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring signup.
The main consequence is a memory leak that can lead to excessive memory consumption, potentially resulting in a denial of service for applications processing untrusted data.
Yes, patches are available in versions 0.3.9.7 and 0.4.4 of the Nanopb package. It is recommended to update to these versions.
If an immediate update is not possible, consider applying the provided workarounds to mitigate the risk of memory leaks.
References
Related vulnerabilities
Recent vulnerabilities recorded for nanopb.
