Expired pointer dereference in libevent - #VU136949

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to a dangling pointer in evbuffer_add_buffer_reference when handling a buffer state where out_total_len == 0. A remote attacker can trigger a specific sequence of buffer operations to disclose sensitive information.

The issue was found by fuzzing, and exploitation appears to require a specific sequence of buffer operations.

Affected software

Remediation

External References

• https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-cg4r-88c8
• https://github.com/libevent/libevent/blob/a994a52d5373d6284b27576efa617aff2baa7bd3/buffer.c#L1037-L1078

Related Security Bulletins

• Multiple vulnerabilities in libevent