CVE-2019-12410: Memory Array Data Uninitialized in Apache Arrow
Summary
CVE-2019-12410: While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. Affects pyarrow versions >= 0.12.0, < 0.15.0. Fixed in 0.15.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Arrow is an open-source software development platform that provides a columnar in-memory analytics layer for big data processing. It offers a set of libraries and tools for efficient data interchange and processing across various programming languages. The vulnerability identified as CVE-2019-12410 affects Apache Arrow versions 0.12.0 to 0.14.1, impacting the C++, Python, Ruby, and R implementations. This vulnerability specifically involves uninitialized memory in Array data when reading RLE null data from Parquet. If the uninitialized memory is transmitted over the wire or persisted in streaming IPC and file formats, it could potentially be shared and exploited.
Vulnerability Detail
The vulnerability in Apache Arrow versions 0.12.0 to 0.14.1 arises from the uninitialized memory in Array data when processing RLE null data from Parquet. This issue affects the C++, Python, Ruby, and R implementations. If the uninitialized memory is transmitted over the wire or stored in streaming IPC and file formats, it can be accessed and potentially exploited by malicious actors. The impact of this vulnerability could range from information disclosure to remote code execution, depending on how the uninitialized memory is utilized. It is crucial to address this vulnerability to ensure the integrity and security of data processed using Apache Arrow.
How To Fix
Minimum fixed version
0.15.0
This is the first release that contains the fix.
pip install --upgrade "pyarrow==0.15.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by avoiding the transmission of uninitialized memory over the wire or storing it in streaming IPC and file formats. It is crucial to update to the fixed version of Apache Arrow as soon as possible to eliminate the vulnerability entirely.
Conclusion
The vulnerability identified as CVE-2019-12410 in Apache Arrow versions 0.12.0 to 0.14.1 poses a risk of uninitialized memory in Array data when processing RLE null data from Parquet. This vulnerability affects the C++, Python, Ruby, and R implementations and can lead to information disclosure or remote code execution. It is crucial to update to the fixed version of Apache Arrow (0.15.0 or later) and ensure all dependencies are up to date. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyarrow →
FAQ
Apache Arrow is an open-source software development platform that provides a columnar in-memory analytics layer for big data processing. It offers efficient data interchange and processing across multiple programming languages.
The vulnerability affects Apache Arrow versions 0.12.0 to 0.14.1.
The vulnerability impacts the C++, Python, Ruby, and R implementations of Apache Arrow.
The uninitialized memory in Array data can be accessed and potentially exploited if transmitted over the wire or stored in streaming IPC and file formats. The impact could range from information disclosure to remote code execution.
To fix this vulnerability, it is recommended to upgrade to Apache Arrow version 0.15.0 or later. Ensure that all dependencies are also updated accordingly.
Related vulnerabilities
Recent vulnerabilities recorded for pyarrow.
