UNKNOWN WRITE vulnerability in grok package: grk::TileLengthMarkers::seek
Summary
OSV-2022-501: UNKNOWN WRITE in grk::TileLengthMarkers::seek. Affects grok versions >= 48d2c98b803c5e2ddddaa6281ba02aa7adc4777d, < edecdb89539e32c31b701ba2cf6140737135697a. Fixed in edecdb89539e32c31b701ba2cf6140737135697a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grok package is an open-source library for image compression. It provides functionality for encoding and decoding images using the Grok image compression algorithm. The package is widely used in various applications that require efficient image compression and decompression. However, a vulnerability has been discovered in the package that could potentially allow an attacker to perform an unknown write operation, leading to a crash or other unexpected behavior.
Vulnerability Detail
The vulnerability resides in the grk::TileLengthMarkers::seek function of the grok package. When processing image data, the function fails to properly handle certain input, resulting in an unknown write operation. This can be exploited by an attacker to manipulate the internal state of the library, potentially leading to a crash or other security issues. The vulnerability has been assigned a severity rating of HIGH.
How To Fix
Minimum fixed version
edecdb89539e32c31b701ba2cf6140737135697a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At the moment, there is no known workaround for this vulnerability. It is strongly advised to apply the fix mentioned above to ensure the security and stability of the grok package.
Conclusion
In conclusion, the grok package is affected by a HIGH severity vulnerability that allows an attacker to perform an unknown write operation. To mitigate this issue, users should update to a fixed version of the package and rebuild their applications. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for grok →
FAQ
The grok package is an open-source library for image compression, providing encoding and decoding functionality using the Grok image compression algorithm.
The vulnerability allows an attacker to perform an unknown write operation, potentially leading to a crash or other security issues in applications using the grok package.
To fix the vulnerability, update the grok package to a version that includes the fix. Pull the latest changes from the GitHub repository and rebuild the library.
Currently, there is no known workaround for this vulnerability. Applying the fix is the recommended solution.
For more information, refer to the OSS-Fuzz report at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48224
References
Related vulnerabilities
Recent vulnerabilities recorded for grok.
