Python/nanopb/0.4.2.dev1063

Nanopb is a small code-size Protocol Buffers implementation in ansi C. It is especially suitable for use in microcontrollers, but fits any memory restricted system.

Repo Link: https://pypi.org/project/nanopb
License: Zlib

2 Security Vulnerabilities

nanopb vulnerable to invalid free() call with oneofs and PB_ENABLE_MALLOC

Published date: 2024-08-30T18:45:41Z

CVE: CVE-2021-21401

Links:

Impact

Decoding a specifically formed message can cause invalid free() or realloc() calls if the message type contains an oneof field, and the oneof directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field is incorrectly treated as if it was a pointer value. Such message data rarely occurs in normal messages, but it is a concern when untrusted data is parsed.

Patches

Preliminary patch is available on git for 0.4.x and 0.3.x branches. The fix will be released in versions 0.3.9.8 and 0.4.5 once testing has been completed.

Workarounds

Following workarounds are available: * Set the option no_unions for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code. * Set the type of all fields inside the oneof to FT_POINTER. This ensures that the data contained inside the union is always a valid pointer. * Heap implementations that guard against invalid free() provide a partial mitigation. Depending on the message type, the pointer value may be attacker controlled and can be used to bypass heap protections.

References

Bug report: https://github.com/nanopb/nanopb/issues/647

For more information

If you have any questions or comments about this advisory, comment on the bug report linked above.

Affected versions: ["0.4.5.post1", "0.4.5.dev1234", "0.4.5.dev1233", "0.4.5.dev1224", "0.4.5.dev1220", "0.4.5.dev1217", "0.4.5.dev1215", "0.4.5.dev1214", "0.4.5.dev1212", "0.4.4", "0.4.4.dev1193", "0.4.4.dev1192", "0.4.4.dev1188", "0.4.4.dev1185", "0.4.4.dev1184", "0.4.4.dev1182", "0.4.4.dev1181", "0.4.3", "0.4.3.dev1177", "0.4.3.dev1175", "0.4.3.dev1172", "0.4.3.dev1164", "0.4.3.dev1150", "0.4.3.dev1137", "0.4.3.dev1133", "0.4.3.dev1132", "0.4.3.dev1131", "0.4.3.dev1128", "0.4.2", "0.4.2.dev1091", "0.4.2.dev1088", "0.4.2.dev1076", "0.4.2.dev1072", "0.4.2.dev1071", "0.4.2.dev1070", "0.4.2.dev1066", "0.4.2.dev1063", "0.4.2.dev1059", "0.4.2.dev1058", "0.4.2.dev1055", "0.4.2.dev1054", "0.4.2.dev1053", "0.4.2.dev1050", "0.4.2.dev1048", "0.4.2.dev1045", "0.4.2.dev1044", "0.4.2.dev1043", "0.4.2.dev1041", "0.4.1", "0.4.1.dev1036", "0.4.1.dev1017", "0.4.1.dev1013", "0.4.1.dev1012", "0.4.1.dev1007", "0.4.1.dev1003", "0.4.1.dev997", "0.4.1.dev996", "0.4.1.dev988", "0.4.1.dev987", "0.4.1.dev985", "0.4.1.dev980", "0.4.1.dev978", "0.4.1.dev971", "0.4.1.dev964", "0.4.1.dev962", "0.4.1.dev961", "0.4.1.dev959", "0.4.0", "0.3.9.7", "0.3.9.6", "0.3.9.5"]

Secure versions: [0.3.9.4.post3, 0.3.9.8, 0.4.0.dev891, 0.4.0.dev892, 0.4.0.dev902, 0.4.0.dev912, 0.4.0.dev932, 0.4.0.dev945, 0.4.0.dev955, 0.4.5, 0.4.6, 0.4.6.dev1237, 0.4.6.dev1238, 0.4.6.dev1239, 0.4.6.dev1252, 0.4.6.dev1253, 0.4.6.dev1254, 0.4.6.dev1256, 0.4.6.dev1264, 0.4.6.dev1268, 0.4.6.dev1270, 0.4.6.dev1276, 0.4.6.dev1277, 0.4.6.dev1303, 0.4.6.dev1304, 0.4.6.dev1313, 0.4.6.dev1315, 0.4.6.dev1322, 0.4.6.dev1324, 0.4.6.dev1325, 0.4.7, 0.4.7.dev1329, 0.4.7.dev1331, 0.4.7.dev1334, 0.4.7.dev1337, 0.4.7.dev1340, 0.4.7.dev1346, 0.4.7.dev1347, 0.4.7.dev1348, 0.4.7.dev1352, 0.4.7.dev1354, 0.4.7.dev1355, 0.4.7.dev1359, 0.4.7.dev1360, 0.4.7.dev1361, 0.4.7.dev1373, 0.4.7.dev1384, 0.4.7.dev1391, 0.4.8, 0.4.8.dev1394, 0.4.8.dev1395, 0.4.8.dev1396, 0.4.8.dev1397, 0.4.8.dev1398, 0.4.8.dev1399, 0.4.8.dev1400, 0.4.8.dev1401, 0.4.8.dev1402, 0.4.8.dev1404, 0.4.8.dev1406, 0.4.8.dev1410, 0.4.8.dev1411, 0.4.8.dev1412, 0.4.8.dev1414, 0.4.8.dev1420, 0.4.8.dev1421, 0.4.8.dev1422, 0.4.8.dev1423, 0.4.8.dev1426, 0.4.8.dev1432, 0.4.8.dev1439, 0.4.8.dev1440, 0.4.8.dev1442, 0.4.9, 0.4.9.1, 0.4.9.dev1444, 0.4.9.dev1445, 0.4.9.dev1446, 0.4.9.dev1448, 0.4.9.dev1452, 0.4.9.dev1453, 0.4.9.dev1454, 0.4.9.dev1455, 0.4.9.dev1460, 0.4.9.dev1464, 0.4.9.dev1465, 0.4.9.dev1472, 0.4.9.dev1473, 0.4.9.dev1474, 0.4.9.dev1477, 0.4.9.dev1479, 0.4.9.dev1481, 0.4.9.dev1483, 0.4.9.dev1484, 0.4.9.dev1485, 0.4.9.dev1492, 0.4.9.dev1494, 1.0.0.dev1496, 1.0.0.dev1499, 1.0.0.dev1505, 1.0.0.dev1510, 1.0.0.dev1513, 1.0.0.dev1514, 1.0.0.dev1527, 1.0.0.dev1528]

Recommendation: Update to version 0.4.9.1.

Memory leak in Nanopb

Published date: 2020-11-25T16:53:27Z

CVE: CVE-2020-26243

Links:

Impact

Decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed.

Patches

Preliminary patch is available on git and problem will be patched in versions 0.3.9.7 and 0.4.4 once testing has been completed.

Workarounds

Following workarounds are available: * Set the option no_unions for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code. * Set the type of the submessage field inside oneof to FT_POINTER. This way the whole submessage will be dynamically allocated and the problematic code is not executed. * Use an arena allocator for nanopb, to make sure all memory can be released afterwards.

References

Bug report: https://github.com/nanopb/nanopb/issues/615

For more information

If you have any questions or comments about this advisory, comment on the bug report linked above.

Affected versions: ["0.4.4.dev1193", "0.4.4.dev1192", "0.4.4.dev1188", "0.4.4.dev1185", "0.4.4.dev1184", "0.4.4.dev1182", "0.4.4.dev1181", "0.4.3", "0.4.3.dev1177", "0.4.3.dev1175", "0.4.3.dev1172", "0.4.3.dev1164", "0.4.3.dev1150", "0.4.3.dev1137", "0.4.3.dev1133", "0.4.3.dev1132", "0.4.3.dev1131", "0.4.3.dev1128", "0.4.2", "0.4.2.dev1091", "0.4.2.dev1088", "0.4.2.dev1076", "0.4.2.dev1072", "0.4.2.dev1071", "0.4.2.dev1070", "0.4.2.dev1066", "0.4.2.dev1063", "0.4.2.dev1059", "0.4.2.dev1058", "0.4.2.dev1055", "0.4.2.dev1054", "0.4.2.dev1053", "0.4.2.dev1050", "0.4.2.dev1048", "0.4.2.dev1045", "0.4.2.dev1044", "0.4.2.dev1043", "0.4.2.dev1041", "0.4.1", "0.4.1.dev1036", "0.4.1.dev1017", "0.4.1.dev1013", "0.4.1.dev1012", "0.4.1.dev1007", "0.4.1.dev1003", "0.4.1.dev997", "0.4.1.dev996", "0.4.1.dev988", "0.4.1.dev987", "0.4.1.dev985", "0.4.1.dev980", "0.4.1.dev978", "0.4.1.dev971", "0.4.1.dev964", "0.4.1.dev962", "0.4.1.dev961", "0.4.1.dev959", "0.4.0", "0.3.9.6", "0.3.9.5"]

Recommendation: Update to version 0.4.9.1.

176 Other Versions

Version	License	Security	Released
0.4.8.dev1400	Zlib		1970-01-01 - 00:00	over 56 years
0.4.8.dev1399	Zlib		1970-01-01 - 00:00	over 56 years
0.4.8.dev1398	Zlib		1970-01-01 - 00:00	over 56 years
0.4.8.dev1397	Zlib		1970-01-01 - 00:00	over 56 years
0.4.8.dev1396	Zlib		1970-01-01 - 00:00	over 56 years
0.4.8.dev1395	Zlib		1970-01-01 - 00:00	over 56 years
0.4.8.dev1394	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1391	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1384	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1373	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1361	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1360	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1359	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1355	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1354	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1352	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1348	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1347	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1346	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1340	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1337	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1334	Zlib		1970-01-01 - 00:00	over 56 years
0.4.7.dev1331	Zlib		2022-07-04 - 02:41	almost 4 years
0.4.7.dev1329	Zlib		2022-06-06 - 02:43	almost 4 years
0.4.6	Zlib		2022-05-30 - 18:02	almost 4 years
0.4.6.dev1325	Zlib		2022-05-30 - 08:43	almost 4 years
0.4.6.dev1324	Zlib		2022-05-30 - 08:30	almost 4 years
0.4.6.dev1322	Zlib		2022-05-02 - 02:42	almost 4 years
0.4.6.dev1315	Zlib		2022-04-04 - 02:36	about 4 years
0.4.6.dev1313	Zlib		2022-03-29 - 11:22	about 4 years
0.4.6.dev1304	Zlib		2022-03-16 - 07:57	about 4 years
0.4.6.dev1303	Zlib		2022-03-07 - 18:29	about 4 years
0.4.6.dev1277	Zlib		2022-02-14 - 05:18	about 4 years
0.4.6.dev1276	Zlib		2022-01-17 - 05:18	about 4 years
0.4.6.dev1270	Zlib		2021-12-27 - 05:19	over 4 years
0.4.6.dev1268	Zlib		2021-12-20 - 05:19	over 4 years
0.4.6.dev1264	Zlib		2021-12-13 - 05:19	over 4 years
0.4.6.dev1256	Zlib		2021-12-06 - 05:19	over 4 years
0.4.6.dev1254	Zlib		2021-11-29 - 05:19	over 4 years
0.4.6.dev1253	Zlib		2021-08-23 - 05:18	over 4 years
0.4.6.dev1252	Zlib		2021-08-09 - 05:18	over 4 years
0.4.6.dev1239	Zlib		2021-04-19 - 05:18	almost 5 years
0.4.6.dev1238	Zlib		2021-04-05 - 05:18	about 5 years
0.4.6.dev1237	Zlib		2021-03-29 - 05:18	about 5 years
0.4.5	Zlib		2021-03-22 - 14:39	about 5 years
0.4.5.post1	Zlib	1	2021-03-22 - 14:49	about 5 years
0.4.5.dev1234	Zlib	1	2021-03-22 - 14:31	about 5 years
0.4.5.dev1233	Zlib	1	2021-03-22 - 14:09	about 5 years
0.4.5.dev1224	Zlib	1	2021-03-22 - 05:18	about 5 years