Out-of-bounds read with an out-of-range `InBuffer::pos`
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 8.2.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
This vulnerability affects the Rust bindings for the zstd (Zstandard) compression library, specifically its streaming interface. An attacker-controlled or invalid buffer position can cause the library to read past the end of the input and compress memory outside the intended data into the output, potentially leaking sensitive information.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
`InBuffer`'s fields are public, so safe code can set `pos` past the end of `src`. The position was passed to the C library unchecked, and `ZSTD_seekable_compressStream`, unlike the other streaming functions, does not validate it: it read past the end of the input slice, by up to the frame size, and compressed that memory into the output. The flaw was corrected by checking the position before every call into the C library.
Timeline
- Advisory published
- Record last updated
Affected versions
- zstd-safecrates.io
From 7.2.2 · fixed in 8.2.0