Out-of-bounds read when training a dictionary from inconsistent sample sizes
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.4.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The zstd Rust crate's dictionary training function (zstd::dict::from_continuous, formerly train_dict) can read past the end of its input buffer when the sample sizes passed in do not match the buffer. This affects programs that train compression dictionaries from sample sizes supplied by untrusted sources, potentially causing memory safety problems such as reading out-of-bounds memory.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
`ZDICT_trainFromBuffer` is never told the length of the samples buffer. Before 0.4.10, `zstd::dict::from_continuous` (initially `train_dict`) called it directly: up to 0.2.1 without checking the sample sizes against the buffer at all, and from 0.3.0 with a sum that wraps around when overflow checks are off, as in release builds. Sizes that do not describe the buffer made the trainer read past its end. This requires the sample sizes to come from an untrusted source. From 0.4.10, training goes through zstd-safe, where the same flaw is covered by the zstd-safe advisory for it, fixed in zstd-safe 8.2.0.
Timeline
- Advisory published
- Record last updated
Affected versions
- zstdcrates.io
From 0.1.1 · fixed in 0.4.10