Heap-buffer-overflow in ndpi_search_http_tcp
Summary
OSV-2022-447: Heap-buffer-overflow in ndpi_search_http_tcp. Affects ndpi versions >= f25deeccb1ccbebd6346271828762fdd8326c32b, < c4f50b2cdac989cc89930564a88a5caab85c7214. Fixed in c4f50b2cdac989cc89930564a88a5caab85c7214. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ndpi package is an open-source library used for deep packet inspection (DPI) of network traffic. It provides functionality to analyze network packets and identify various protocols and applications. This vulnerability affects the ndpi package and specifically the ndpi_search_http_tcp function. The function is responsible for searching and processing HTTP traffic over TCP connections. The vulnerability allows for a heap-buffer-overflow read of 11 bytes, which can lead to a crash of the application or potentially be exploited for remote code execution.
Vulnerability Detail
The vulnerability originates from a heap-buffer-overflow read in the ndpi_search_http_tcp function. When processing HTTP traffic over TCP connections, the function fails to properly validate the size of the buffer being read, leading to the overflow. An attacker could potentially craft a malicious packet that triggers this vulnerability, causing the application to crash or executing arbitrary code. The vulnerability has a medium severity rating.
How To Fix
Minimum fixed version
c4f50b2cdac989cc89930564a88a5caab85c7214
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can implement input validation and boundary checks in their own code when using the ndpi library. By ensuring that the size of the buffer being read is within the expected limits, the vulnerability can be mitigated. Here is an example of how to perform input validation in C:
size_t buffer_size = /* size of the buffer */;
if (buffer_size <= 11) {
// Handle error or reject the packet
}
// Continue processing the packet
Conclusion
The ndpi package is vulnerable to a heap-buffer-overflow read in the ndpi_search_http_tcp function. This can lead to application crashes or potential remote code execution. To mitigate the vulnerability, it is recommended to update the ndpi package to the latest version. Developers can also implement input validation and boundary checks in their own code as a workaround. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ndpi →
FAQ
The ndpi package is an open-source library used for deep packet inspection (DPI) of network traffic. It provides functionality to analyze network packets and identify various protocols and applications.
The vulnerability can lead to a crash of the application or potentially be exploited for remote code execution. It is important to update the ndpi package to prevent these risks.
To fix the vulnerability, update the ndpi package to the latest version. The fix can be found in commit c4f50b2cdac989cc89930564a88a5caab85c7214 of the nDPI repository.
Yes, developers can implement input validation and boundary checks in their own code when using the ndpi library. This can help mitigate the vulnerability.
You can find more information about this vulnerability in the OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47734
References
Related vulnerabilities
Recent vulnerabilities recorded for ndpi.
