CVE-2020-8927: Brotli Library Buffer Overflow

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

The Brotli library is a compression algorithm developed by Google. It is widely used for compressing data in various applications and libraries. The library provides both a "one-shot" API and a "streaming" API for decompression. The vulnerability in the Brotli library versions prior to 1.0.8 allows an attacker to trigger a buffer overflow by controlling the input length of a "one-shot" decompression request. This can lead to a crash when copying over chunks of data larger than 2 GiB.

Vulnerability Detail

The buffer overflow vulnerability in the Brotli library arises due to improper handling of input length in a "one-shot" decompression request. By manipulating the input length, an attacker can cause the library to copy chunks of data larger than 2 GiB, resulting in a buffer overflow. This can lead to a crash of the application using the library. The impact of this vulnerability can vary depending on the context in which the library is used. In some cases, it may allow an attacker to execute arbitrary code or cause a denial-of-service condition.

pip install --upgrade "brotli==1.2.1"

pip install --upgrade "brotli==1.0.8"

Workaround

If updating the Brotli library is not feasible, using the "streaming" API instead of the "one-shot" API can provide a workaround. By using the "streaming" API, the decompression process can be divided into smaller chunks, reducing the risk of triggering the buffer overflow. Here is an example of using the "streaming" API in Python:

import brotli

def decompress_data(data):
    decompressor = brotli.Decompressor()
    output = b''
    for chunk in data:
        output += decompressor.process(chunk)
    output += decompressor.finish()
    return output

In this example, the data is decompressed in smaller chunks using the process() method of the decompressor object.

Conclusion

The buffer overflow vulnerability in the Brotli library can be mitigated by updating to version 1.0.8 or later. If updating is not possible, using the "streaming" API and imposing chunk size limits can provide a workaround. It is important to take action to protect systems and applications that use the Brotli library. For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for brotli →

FAQ