CVE-2023-45681 Out of bounds heap buffer write in stb_vorbis

2023-10-2023:26:56

CWE-787

GitHub_M

github.com

stb_vorbis

heap buffer write

integer overflow

memory allocation

code execution

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

7.6

Confidence

Low

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in start_decoder. The root cause is a potential integer overflow in sizeof(char*) * (f->comment_list_length) which may make setup_malloc allocate less memory than required. Since there is another integer overflow an attacker may overflow it too to force setup_malloc to return 0 and make the exploit more reliable. This issue may lead to code execution.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:nothings:stb:*:*:*:*:*:*:*:*"
    ],
    "vendor": "nothings",
    "product": "stb",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.22"
      }
    ],
    "defaultStatus": "unknown"
  }
]