CVE-2023-45677 Heap buffer out of bounds write in start_decoder in stb_vorbis

2023-10-2023:26:49

CWE-787

GitHub_M

github.com

cve-2023-45677

heap buffer

out of bounds write

stb_vorbis

code execution

integer overflow

memory allocation

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

7.9

Confidence

High

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in f->vendor[len] = (char)'\0';. The root cause is that if len read in start_decoder is a negative number and setup_malloc successfully allocates memory in that case, but memory write is done with a negative index len. Similarly if len is INT_MAX the integer overflow len+1 happens in f->vendor = (char*)setup_malloc(f, sizeof(char) * (len+1)); and f->comment_list[i] = (char*)setup_malloc(f, sizeof(char) * (len+1));. This issue may lead to code execution.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:nothings:stb:*:*:*:*:*:*:*:*"
    ],
    "vendor": "nothings",
    "product": "stb",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.22"
      }
    ],
    "defaultStatus": "unknown"
  }
]