Python/nanopb/0.4.3.dev1164

Nanopb is a small code-size Protocol Buffers implementation in ansi C. It is especially suitable for use in microcontrollers, but fits any memory restricted system.

https://pypi.org/project/nanopb
Zlib

2 Security Vulnerabilities

nanopb vulnerable to invalid free() call with oneofs and PB_ENABLE_MALLOC

Published date: 2024-08-30T18:45:41Z
CVE: CVE-2021-21401
Links:

Impact

Decoding a specifically formed message can cause invalid free() or realloc() calls if the message type contains an oneof field, and the oneof directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field is incorrectly treated as if it was a pointer value. Such message data rarely occurs in normal messages, but it is a concern when untrusted data is parsed.

Patches

Preliminary patch is available on git for 0.4.x and 0.3.x branches. The fix will be released in versions 0.3.9.8 and 0.4.5 once testing has been completed.

Workarounds

Following workarounds are available: * Set the option no_unions for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code. * Set the type of all fields inside the oneof to FT_POINTER. This ensures that the data contained inside the union is always a valid pointer. * Heap implementations that guard against invalid free() provide a partial mitigation. Depending on the message type, the pointer value may be attacker controlled and can be used to bypass heap protections.

References

Bug report: https://github.com/nanopb/nanopb/issues/647

For more information

If you have any questions or comments about this advisory, comment on the bug report linked above.

Affected versions: ["0.4.5.post1", "0.4.5.dev1234", "0.4.5.dev1233", "0.4.5.dev1224", "0.4.5.dev1220", "0.4.5.dev1217", "0.4.5.dev1215", "0.4.5.dev1214", "0.4.5.dev1212", "0.4.4", "0.4.4.dev1193", "0.4.4.dev1192", "0.4.4.dev1188", "0.4.4.dev1185", "0.4.4.dev1184", "0.4.4.dev1182", "0.4.4.dev1181", "0.4.3", "0.4.3.dev1177", "0.4.3.dev1175", "0.4.3.dev1172", "0.4.3.dev1164", "0.4.3.dev1150", "0.4.3.dev1137", "0.4.3.dev1133", "0.4.3.dev1132", "0.4.3.dev1131", "0.4.3.dev1128", "0.4.2", "0.4.2.dev1091", "0.4.2.dev1088", "0.4.2.dev1076", "0.4.2.dev1072", "0.4.2.dev1071", "0.4.2.dev1070", "0.4.2.dev1066", "0.4.2.dev1063", "0.4.2.dev1059", "0.4.2.dev1058", "0.4.2.dev1055", "0.4.2.dev1054", "0.4.2.dev1053", "0.4.2.dev1050", "0.4.2.dev1048", "0.4.2.dev1045", "0.4.2.dev1044", "0.4.2.dev1043", "0.4.2.dev1041", "0.4.1", "0.4.1.dev1036", "0.4.1.dev1017", "0.4.1.dev1013", "0.4.1.dev1012", "0.4.1.dev1007", "0.4.1.dev1003", "0.4.1.dev997", "0.4.1.dev996", "0.4.1.dev988", "0.4.1.dev987", "0.4.1.dev985", "0.4.1.dev980", "0.4.1.dev978", "0.4.1.dev971", "0.4.1.dev964", "0.4.1.dev962", "0.4.1.dev961", "0.4.1.dev959", "0.4.0", "0.3.9.7", "0.3.9.6", "0.3.9.5"]
Secure versions: [0.3.9.4.post3, 0.3.9.8, 0.4.0.dev891, 0.4.0.dev892, 0.4.0.dev902, 0.4.0.dev912, 0.4.0.dev932, 0.4.0.dev945, 0.4.0.dev955, 0.4.5, 0.4.6, 0.4.6.dev1237, 0.4.6.dev1238, 0.4.6.dev1239, 0.4.6.dev1252, 0.4.6.dev1253, 0.4.6.dev1254, 0.4.6.dev1256, 0.4.6.dev1264, 0.4.6.dev1268, 0.4.6.dev1270, 0.4.6.dev1276, 0.4.6.dev1277, 0.4.6.dev1303, 0.4.6.dev1304, 0.4.6.dev1313, 0.4.6.dev1315, 0.4.6.dev1322, 0.4.6.dev1324, 0.4.6.dev1325, 0.4.7, 0.4.7.dev1329, 0.4.7.dev1331, 0.4.7.dev1334, 0.4.7.dev1337, 0.4.7.dev1340, 0.4.7.dev1346, 0.4.7.dev1347, 0.4.7.dev1348, 0.4.7.dev1352, 0.4.7.dev1354, 0.4.7.dev1355, 0.4.7.dev1359, 0.4.7.dev1360, 0.4.7.dev1361, 0.4.7.dev1373, 0.4.7.dev1384, 0.4.7.dev1391, 0.4.8, 0.4.8.dev1394, 0.4.8.dev1395, 0.4.8.dev1396, 0.4.8.dev1397, 0.4.8.dev1398, 0.4.8.dev1399, 0.4.8.dev1400, 0.4.8.dev1401, 0.4.8.dev1402, 0.4.8.dev1404, 0.4.8.dev1406, 0.4.8.dev1410, 0.4.8.dev1411, 0.4.8.dev1412, 0.4.8.dev1414, 0.4.8.dev1420, 0.4.8.dev1421, 0.4.8.dev1422, 0.4.8.dev1423, 0.4.8.dev1426, 0.4.8.dev1432, 0.4.8.dev1439, 0.4.8.dev1440, 0.4.8.dev1442, 0.4.9, 0.4.9.1, 0.4.9.dev1444, 0.4.9.dev1445, 0.4.9.dev1446, 0.4.9.dev1448, 0.4.9.dev1452, 0.4.9.dev1453, 0.4.9.dev1454, 0.4.9.dev1455, 0.4.9.dev1460, 0.4.9.dev1464, 0.4.9.dev1465, 0.4.9.dev1472, 0.4.9.dev1473, 0.4.9.dev1474, 0.4.9.dev1477, 0.4.9.dev1479, 0.4.9.dev1481, 0.4.9.dev1483, 0.4.9.dev1484, 0.4.9.dev1485, 0.4.9.dev1492, 0.4.9.dev1494, 1.0.0.dev1496, 1.0.0.dev1499, 1.0.0.dev1505, 1.0.0.dev1510, 1.0.0.dev1513, 1.0.0.dev1514, 1.0.0.dev1527, 1.0.0.dev1528]
Recommendation: Update to version 0.4.9.1.

Memory leak in Nanopb

Published date: 2020-11-25T16:53:27Z
CVE: CVE-2020-26243
Links:

Impact

Decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed.

Patches

Preliminary patch is available on git and problem will be patched in versions 0.3.9.7 and 0.4.4 once testing has been completed.

Workarounds

Following workarounds are available: * Set the option no_unions for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code. * Set the type of the submessage field inside oneof to FT_POINTER. This way the whole submessage will be dynamically allocated and the problematic code is not executed. * Use an arena allocator for nanopb, to make sure all memory can be released afterwards.

References

Bug report: https://github.com/nanopb/nanopb/issues/615

For more information

If you have any questions or comments about this advisory, comment on the bug report linked above.

Affected versions: ["0.4.4.dev1193", "0.4.4.dev1192", "0.4.4.dev1188", "0.4.4.dev1185", "0.4.4.dev1184", "0.4.4.dev1182", "0.4.4.dev1181", "0.4.3", "0.4.3.dev1177", "0.4.3.dev1175", "0.4.3.dev1172", "0.4.3.dev1164", "0.4.3.dev1150", "0.4.3.dev1137", "0.4.3.dev1133", "0.4.3.dev1132", "0.4.3.dev1131", "0.4.3.dev1128", "0.4.2", "0.4.2.dev1091", "0.4.2.dev1088", "0.4.2.dev1076", "0.4.2.dev1072", "0.4.2.dev1071", "0.4.2.dev1070", "0.4.2.dev1066", "0.4.2.dev1063", "0.4.2.dev1059", "0.4.2.dev1058", "0.4.2.dev1055", "0.4.2.dev1054", "0.4.2.dev1053", "0.4.2.dev1050", "0.4.2.dev1048", "0.4.2.dev1045", "0.4.2.dev1044", "0.4.2.dev1043", "0.4.2.dev1041", "0.4.1", "0.4.1.dev1036", "0.4.1.dev1017", "0.4.1.dev1013", "0.4.1.dev1012", "0.4.1.dev1007", "0.4.1.dev1003", "0.4.1.dev997", "0.4.1.dev996", "0.4.1.dev988", "0.4.1.dev987", "0.4.1.dev985", "0.4.1.dev980", "0.4.1.dev978", "0.4.1.dev971", "0.4.1.dev964", "0.4.1.dev962", "0.4.1.dev961", "0.4.1.dev959", "0.4.0", "0.3.9.6", "0.3.9.5"]
Secure versions: [0.3.9.4.post3, 0.3.9.8, 0.4.0.dev891, 0.4.0.dev892, 0.4.0.dev902, 0.4.0.dev912, 0.4.0.dev932, 0.4.0.dev945, 0.4.0.dev955, 0.4.5, 0.4.6, 0.4.6.dev1237, 0.4.6.dev1238, 0.4.6.dev1239, 0.4.6.dev1252, 0.4.6.dev1253, 0.4.6.dev1254, 0.4.6.dev1256, 0.4.6.dev1264, 0.4.6.dev1268, 0.4.6.dev1270, 0.4.6.dev1276, 0.4.6.dev1277, 0.4.6.dev1303, 0.4.6.dev1304, 0.4.6.dev1313, 0.4.6.dev1315, 0.4.6.dev1322, 0.4.6.dev1324, 0.4.6.dev1325, 0.4.7, 0.4.7.dev1329, 0.4.7.dev1331, 0.4.7.dev1334, 0.4.7.dev1337, 0.4.7.dev1340, 0.4.7.dev1346, 0.4.7.dev1347, 0.4.7.dev1348, 0.4.7.dev1352, 0.4.7.dev1354, 0.4.7.dev1355, 0.4.7.dev1359, 0.4.7.dev1360, 0.4.7.dev1361, 0.4.7.dev1373, 0.4.7.dev1384, 0.4.7.dev1391, 0.4.8, 0.4.8.dev1394, 0.4.8.dev1395, 0.4.8.dev1396, 0.4.8.dev1397, 0.4.8.dev1398, 0.4.8.dev1399, 0.4.8.dev1400, 0.4.8.dev1401, 0.4.8.dev1402, 0.4.8.dev1404, 0.4.8.dev1406, 0.4.8.dev1410, 0.4.8.dev1411, 0.4.8.dev1412, 0.4.8.dev1414, 0.4.8.dev1420, 0.4.8.dev1421, 0.4.8.dev1422, 0.4.8.dev1423, 0.4.8.dev1426, 0.4.8.dev1432, 0.4.8.dev1439, 0.4.8.dev1440, 0.4.8.dev1442, 0.4.9, 0.4.9.1, 0.4.9.dev1444, 0.4.9.dev1445, 0.4.9.dev1446, 0.4.9.dev1448, 0.4.9.dev1452, 0.4.9.dev1453, 0.4.9.dev1454, 0.4.9.dev1455, 0.4.9.dev1460, 0.4.9.dev1464, 0.4.9.dev1465, 0.4.9.dev1472, 0.4.9.dev1473, 0.4.9.dev1474, 0.4.9.dev1477, 0.4.9.dev1479, 0.4.9.dev1481, 0.4.9.dev1483, 0.4.9.dev1484, 0.4.9.dev1485, 0.4.9.dev1492, 0.4.9.dev1494, 1.0.0.dev1496, 1.0.0.dev1499, 1.0.0.dev1505, 1.0.0.dev1510, 1.0.0.dev1513, 1.0.0.dev1514, 1.0.0.dev1527, 1.0.0.dev1528]
Recommendation: Update to version 0.4.9.1.

176 Other Versions

Version License Security Released
1.0.0.dev1528 Zlib 1970-01-01 - 00:00 over 56 years
1.0.0.dev1527 Zlib 1970-01-01 - 00:00 over 56 years
1.0.0.dev1514 Zlib 1970-01-01 - 00:00 over 56 years
1.0.0.dev1513 Zlib 1970-01-01 - 00:00 over 56 years
1.0.0.dev1510 Zlib 1970-01-01 - 00:00 over 56 years
1.0.0.dev1505 Zlib 1970-01-01 - 00:00 over 56 years
1.0.0.dev1499 Zlib 1970-01-01 - 00:00 over 56 years
1.0.0.dev1496 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.1 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1494 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1492 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1485 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1484 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1483 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1481 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1479 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1477 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1474 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1473 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1472 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1465 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1464 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1460 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1455 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1454 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1453 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1452 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1448 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1446 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1445 Zlib 1970-01-01 - 00:00 over 56 years
0.4.9.dev1444 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1442 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1440 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1439 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1432 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1426 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1423 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1422 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1421 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1420 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1414 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1412 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1411 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1410 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1406 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1404 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1402 Zlib 1970-01-01 - 00:00 over 56 years
0.4.8.dev1401 Zlib 1970-01-01 - 00:00 over 56 years