Segmentation Fault Vulnerability in Shaderc Package
Summary
OSV-2024-1446: Segv on unknown address in glslang::TIntermediate::addSymbol. Affects shaderc versions >= ffd3be52bbcbd428e9de40da996ad09645fc0dc8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shaderc is an open-source library that provides tools for compiling shaders in the Vulkan graphics API. It is designed to facilitate the development of graphics applications by allowing developers to write shaders in high-level languages and compile them into a format suitable for use with Vulkan. The library is widely used in graphics programming, and its robustness is critical for the stability of applications that rely on it. However, it has recently been identified that Shaderc is vulnerable to a segmentation fault due to improper handling of function calls in its parsing context.
Vulnerability Detail
The vulnerability, identified as OSV-2024-1446, originates from a segmentation fault (Segv) occurring on an unknown address within the glslang::TIntermediate::addSymbol function. This issue arises during the handling of function calls in the HlslParseContext, specifically when transforming entry points. The ramifications of this vulnerability include potential crashes of applications that utilize Shaderc, leading to instability and a poor user experience. The crash can be triggered under certain conditions, making it a significant concern for developers relying on this library.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can avoid triggering the vulnerability by implementing additional checks in their shader code to prevent invalid function calls. This may involve validating function parameters and ensuring that all entry points are correctly defined before compilation.
Conclusion
The segmentation fault vulnerability in the Shaderc package poses a significant risk to applications that rely on it for shader compilation. It is crucial for developers to update to the latest patched version to ensure stability and prevent crashes. Implementing workarounds can provide temporary relief, but the best course of action is to address the vulnerability directly through updates.
See every vulnerability recorded for shaderc →
FAQ
OSV-2024-1446 is the identifier for a segmentation fault vulnerability found in the Shaderc package, which can lead to application crashes.
This vulnerability can cause applications that use Shaderc to crash unexpectedly, leading to a poor user experience and potential data loss.
Yes, a patched version of Shaderc is available. It is advisable to update to the latest version to mitigate this vulnerability.
If an immediate update is not possible, consider implementing additional checks in your shader code to avoid triggering the vulnerability as a temporary workaround.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for shaderc.
