Bug 2290551 (CVE-2024-36124)

Summary: CVE-2024-36124 snappy: tries to read outside the bounds of the given byte arrays
Product: [Other] Security Response Reporter: Rohit Keshri <rkeshri>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, adudiak, adupliak, anstephe, arnavarr, asoldano, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, boliveir, brian.stansberry, brking, ccranfor, cdewolf, chazlett, chfoley, clement.escoffier, cmiranda, csutherl, dandread, darran.lofthouse, dhanak, dkreling, dosoudil, drichtar, dsimansk, eaguilar, ebaron, epacific, eric.wittmann, fjuma, fmariani, fmongiar, gmalinko, gsmet, hamadhan, haoli, hkataria, ibek, istudens, ivassile, iweiss, janstey, jcammara, jcantril, jclere, jhardy, jkang, jkoops, jmartisk, jmitchel, jneedle, jnethert, jobarker, jpallich, jpechane, jpoth, jrokos, jscholz, kingland, kshier, kverlaen, lgao, lthon, mabashia, manderse, matzew, max.andersen, mnovotny, mosmerov, msochure, mstefank, msvehla, mulliken, nipatil, nwallace, olubyans, omaciel, pantinor, parichar, pbraun, pcongius, pdelbell, pdrozd, peholase, pgallagh, pierdipi, pjindal, plodge, pmackay, probinso, pskopek, rguimara, rhuss, rjohnson, rkieley, rkubis, rmartinc, rowaters, rruss, rstancel, rstepani, rsvoboda, saroy, sausingh, sbiarozk, sdouglas, sfroberg, simaishi, smaestri, smcdonal, stcannon, sthorger, swoodman, szappis, tasato, tcunning, teagle, tfister, thavo, tom.jenkinson, tqvarnst, yfang, yguenane, zsadeh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the iq80 Snappy compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed, and this has similar security consequences as out-of-bounds access in C or C++. This issue can lead to non-deterministic behavior or crash the JVM.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2290550    

Description Rohit Keshri 2024-06-05 13:23:04 UTC
iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. iq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5.

https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9