CVE-2022-4899: Buffer Overrun Vulnerability in zstd
Summary
CVE-2022-4899: A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun. Affects zstd versions 1.1.4 – 1.5.5.1. No fix is published. How to fix ↓
Also tracked for
- github.com/facebook/zstd · SwiftURL
- libzstd · Debian:11
The same CVE-2022-4899 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
zstd is a compression library and command-line tool that provides fast and efficient compression and decompression capabilities. It is commonly used in various applications to reduce file sizes and improve data transfer speeds. However, zstd version 1.4.10 is vulnerable to a buffer overrun when an empty string is supplied as an argument to the command-line tool.
Vulnerability Detail
The vulnerability in zstd v1.4.10 allows an attacker to exploit a buffer overrun by providing an empty string as a command-line argument. This can lead to a variety of potential consequences, including remote code execution, denial of service, or information disclosure. The buffer overrun occurs due to insufficient input validation, allowing the attacker to overwrite adjacent memory regions and potentially execute arbitrary code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid supplying empty strings as command-line arguments to the zstd tool. By ensuring that valid input is provided, the risk of triggering the buffer overrun can be minimized. However, this is not a permanent solution and should be considered a temporary measure until the software is updated.
Conclusion
In conclusion, zstd version 1.4.10 is vulnerable to a buffer overrun when an empty string is supplied as a command-line argument. This vulnerability can have severe consequences, including remote code execution and information disclosure. It is crucial to update zstd to a patched version or apply the recommended workaround until the software is updated. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zstd →
FAQ
zstd is a compression library and command-line tool used for fast and efficient data compression and decompression.
The vulnerability allows an attacker to trigger a buffer overrun, potentially leading to remote code execution, denial of service, or information disclosure.
To fix this vulnerability, update zstd to a version that includes the necessary patches, preferably the latest version available.
As a temporary workaround, avoid supplying empty strings as command-line arguments to the zstd tool.
For more information about this vulnerability, refer to the official advisory provided by the maintainers of zstd.
References
Related vulnerabilities
Recent vulnerabilities recorded for zstd.
