Use-of-uninitialized-value in libidn2: _idn2_punycode_decode
Summary
OSV-2020-480: Use-of-uninitialized-value in _idn2_punycode_decode. Affects libidn2 versions >= ce0d453222ca51c056f4f442988710eb0b696365, < 734ef70e7e719e7aa777dbafbc727225bf71980a. Fixed in 734ef70e7e719e7aa777dbafbc727225bf71980a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libidn2 is a library that provides support for Internationalized Domain Names (IDNs). It allows applications to convert domain names between their ASCII and Unicode representations. The library is commonly used in software that deals with domain name handling and DNS resolution. However, a vulnerability has been discovered in the library that could lead to the use of uninitialized values during the decoding of Punycode strings.
Vulnerability Detail
The vulnerability in libidn2, specifically in the _idn2_punycode_decode function, can result in the use of uninitialized values. This can lead to unpredictable behavior and potentially allow an attacker to exploit the vulnerability for malicious purposes. The issue was reported through the OSS-Fuzz project, and the crash state indicates that the problem occurs during the execution of the _tr46 and idn2_lookup_u8 functions.
How To Fix
Minimum fixed version
734ef70e7e719e7aa777dbafbc727225bf71980a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can manually initialize the values used in the vulnerable code section before calling the _idn2_punycode_decode function. This can help mitigate the risk of encountering uninitialized values and potential crashes. Here is an example of how the values can be initialized:
// Initialize variables
int variable1 = 0;
char variable2 = '\0';
// Call _idn2_punycode_decode with initialized values
_idn2_punycode_decode(variable1, variable2);
Conclusion
In conclusion, the libidn2 library is vulnerable to a use-of-uninitialized-value issue in the _idn2_punycode_decode function. This vulnerability can have unpredictable consequences and may be exploited by attackers. It is recommended to update to a fixed version of the library or apply the provided workaround to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libidn2 →
FAQ
libidn2 is a library that provides support for Internationalized Domain Names (IDNs). It allows applications to convert domain names between their ASCII and Unicode representations.
The vulnerability can result in the use of uninitialized values during the decoding of Punycode strings. This can lead to unpredictable behavior and potentially allow an attacker to exploit the vulnerability for malicious purposes.
The vulnerability was discovered through the OSS-Fuzz project, which focuses on fuzzing and finding vulnerabilities in open source software.
Yes, the vulnerability has been fixed in commit 734ef70e7e719e7aa777dbafbc727225bf71980a of the libidn2 Git repository.
Yes, developers can manually initialize the values used in the vulnerable code section to mitigate the risk of encountering uninitialized values and potential crashes.
References
Related vulnerabilities
Recent vulnerabilities recorded for libidn2.
