Race condition in Zstandard - CVE-2019-11922

Vulnerability identifier: #VU20060

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-11922

CWE-ID: CWE-362

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows an attacker to execute arbitrary code on the target system.

The vulnerability exists due to a race condition in the one-pass compression functions. A remote attacker can exploit the race and write bytes out of bounds if an output buffer smaller than the recommended size was used.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on the target system.

Zstandard
VMware Tanzu Application Service for VMs
Isolation Segment
libzstd (Ubuntu package)
zstd (Alpine package)
zstd (Ubuntu package)
libzstd1 (Ubuntu package)
SUSE Linux
Opensuse
Ubuntu
Tanzu Greenplum for Kubernetes
VMware Tanzu Operations Manager

Install updates from vendor's website.

Zstandard - update to 1.3.8
libzstd (Ubuntu package) - update to 1.3.3+dfsg-2ubuntu1.1
zstd (Alpine package) - update to 1.4.5-r0
Tanzu Greenplum for Kubernetes - update to 1.2.0
zstd (Ubuntu package) - update to 1.3.1+dfsg1~ubuntu0.16.04.1+esm2
libzstd1 (Ubuntu package) - update to 1.3.1+dfsg1~ubuntu0.16.04.1+esm2
VMware Tanzu Operations Manager - addressed in versions 2.9.43, 2.10.47

• https://github.com/facebook/zstd/pull/1404/commits/3e5cdf1b6a85843e991d7d10f6a2567c15580da0
• https://www.facebook.com/security/advisories/cve-2019-11922

• OpenSUSE Linux update for zstd
• Race condition in Zstandard
• OpenSUSE Linux update for zstd
• Ubuntu update for Zstandard
• OpenSUSE Linux update for zstd
• Race condition in zstd (Alpine package)
• Ubuntu update for libzstd
• VMware Tanzu products update for Zstandard