SB20261109110 - Multiple vulnerabilities in Nanopb

Description

This security bulletin contains information about 2 vulnerabilities.

1) Access of Uninitialized Pointer (CVE-ID: N/A)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a low-privileged remote attacker to redirect execution to an attacker-controlled address and crash an application using Nanopb.

The vulnerability exists due to uncleared union storage when decoding a callback directly inside a mixed-field oneof with no_unions set to false and submsg_callback unused. A low-privileged remote attacker can send a message containing a non-callback field followed by the callback field, causing decoded data to be invoked as a function pointer.

2) Uncontrolled Recursion (CVE-ID: N/A)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to cause denial of service by crashing an application that decodes messages with Nanopb.

The vulnerability exists due to unbounded recursion in Nanopb's message decoder when processing deeply nested data against cyclic message definitions using callbacks or PB_ENABLE_MALLOC. An unauthenticated remote attacker can submit a specially crafted message with excessive nesting to exhaust the application's stack.

Remediation

Install update from vendor's website.

References

• https://github.com/nanopb/nanopb/security/advisories/GHSA-p24j-vqcp-x988
• https://github.com/nanopb/nanopb/security/advisories/GHSA-9w99-4pfq-6396