#VU76724 Release of invalid pointer or reference in Nanopb - CVE-2021-21401

Vulnerability identifier: #VU76724

Vulnerability risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-21401

CWE-ID: CWE-763

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Nanopb
Web applications / JS libraries

Vendor: Nanopb Project

Description

The vulnerability allows a local user to preform a denial of service (DoS) attack.

The vulnerability exists due to release of invalid pointer. A local user can pass a specially crafted message to the application and perform a denial of service attack.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Nanopb: 0.3.6 - 0.3.9.7, 0.4.0 - 0.4.4

---

External links
https://github.com/nanopb/nanopb/blob/c9124132a604047d0ef97a09c0e99cd9bed2c818/CHANGELOG.txt#L1
https://github.com/nanopb/nanopb/commit/e2f0ccf939d9f82931d085acb6df8e9a182a4261
https://github.com/nanopb/nanopb/issues/647
https://github.com/nanopb/nanopb/security/advisories/GHSA-7mv5-5mxh-qg88

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.