Critical Stack Buffer Overflow Vulnerability in Tarantool
Summary
OSV-2025-267: Stack-buffer-overflow in snap_usedef. Affects tarantool versions >= 3d97334fa3e1ea6a94058c73137f115eb2160b3c, < 8c7cfb1cd0b3f5ce1d5b181403f68f7aaf657d9a. Fixed in 8c7cfb1cd0b3f5ce1d5b181403f68f7aaf657d9a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tarantool is an open-source in-memory database and application server designed for high performance and scalability. It supports Lua scripting and is often used for building real-time applications. The package is known for its flexibility and speed, making it a popular choice among developers. However, it has been identified to have a critical vulnerability that can lead to severe security issues.
Vulnerability Detail
The vulnerability is a stack-buffer-overflow that occurs in the function 'snap_usedef' within the Tarantool codebase. This issue was introduced in commit 3d97334fa3e1ea6a94058c73137f115eb2160b3c. If exploited, this vulnerability can lead to crashes and potential arbitrary code execution, compromising the integrity of the application. The crash state indicates that the overflow happens during the execution of Lua scripts, which can be triggered by malicious input.
How To Fix
Minimum fixed version
8c7cfb1cd0b3f5ce1d5b181403f68f7aaf657d9a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to sanitize any user inputs that may trigger the vulnerable function. This can help mitigate the risk until a patch is applied. For example, ensure that any Lua scripts executed do not contain unexpected or malicious data.
Conclusion
The stack buffer overflow vulnerability in Tarantool poses significant risks to applications utilizing this package. It is crucial to update to the latest version to mitigate these risks and ensure the security of your application. Implementing input validation can serve as a temporary measure while awaiting a patch.
See every vulnerability recorded for tarantool →
FAQ
A stack buffer overflow occurs when data exceeds the allocated buffer space on the stack, potentially overwriting adjacent memory and leading to crashes or code execution.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to analyze your manifest file.
Failing to address this vulnerability can lead to application crashes, data corruption, and unauthorized access to sensitive information, putting your entire system at risk.
Yes, updating to the latest version of Tarantool that includes the patch for this vulnerability will ensure that your application is secure.
It is advisable to regularly check for vulnerabilities, especially after updates or changes to your application. Using tools like Vulert can help automate this process.
References
Related vulnerabilities
Recent vulnerabilities recorded for tarantool.
