out-of-bounds read possible when setting list-of-pointers
If a message consumer expects data of type "list of pointers", and if the consumer performs certain specific actions on such data, then a message producer can cause the consumer to read out-of-bounds memory. This could trigger a process crash in the consumer, or in some cases could allow exfiltration of private in-memory data. The C++ Cap'n Proto library is also affected by this bug. See the [advisory](https://github.com/capnproto/capnproto/tree/master/security-advisories/2022-11-30-0-pointer-list-bounds.md) on the main Cap'n Proto repo for a succinct description of the exact circumstances in which the problem can arise.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-46149US | medium5.4 | — | ||
Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's… | ||||
references
External citations — patches, advisories, analysis.
- https://crates.io/crates/capnpPACKAGE
- https://dwrensha.github.io/capnproto-rust/2022/11/30/out_of_bounds_memory_access_bug.htmlWEB
- https://github.com/capnproto/capnproto/security/advisories/GHSA-qqff-4vw4-f6hxADVISORY
- https://github.com/capnproto/capnproto/tree/master/security-advisories/2022-11-30-0-pointer-list-bounds.mdWEB
- https://rustsec.org/advisories/RUSTSEC-2022-0068.htmlADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan