CVE-2022-46149
Cap'n Proto vulnerable to out-of-bounds read due to logic error handling list-of-list.
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to out-of-bounds read due to logic error handling list-of-list. This issue may lead someone to remotely segfault a peer by sending it a malicious message, if the victim performs certain actions on a list-of-pointer type. Exfiltration of memory is possible if the victim performs additional certain actions on a list-of-pointer type. To be vulnerable, an application must perform a specific sequence of actions, described in the GitHub Security Advisory. The bug is present in inlined code, therefore the fix will require rebuilding dependent applications. Cap'n Proto has C++ fixes available in versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3. The `capnp` Rust crate has fixes available in versions 0.13.7, 0.14.11, and 0.15.2.
Cap'n Proto es un formato de intercambio de datos y un sistema de llamada a procedimiento remoto (RPC). Cap'n Proro anterior a las versiones 0.7.1, 0.8.1, 0.9.2 y 0.10.3, así como las versiones de la implementación Rust de Cap'n Proto anteriores a 0.13.7, 0.14.11 y 0.15.2 son vulnerable a lecturas fuera de límites debido a un error lógico al manejar la lista de listas. Este problema puede llevar a que alguien segmente remotamente a un par enviándole un mensaje malicioso, si la víctima realiza ciertas acciones en un tipo de lista de punteros. La exfiltración de memoria es posible si la víctima realiza ciertas acciones adicionales en un tipo de lista de punteros. Para ser vulnerable, una aplicación debe realizar una secuencia específica de acciones, descrita en el Aviso de seguridad de GitHub. El error está presente en el código integrado, por lo que para solucionarlo será necesario reconstruir las aplicaciones dependientes. Cap'n Proto tiene correcciones de C++ disponibles en las versiones 0.7.1, 0.8.1, 0.9.2 y 0.10.3. La caja Rust `capnp` tiene correcciones disponibles en las versiones 0.13.7, 0.14.11 y 0.15.2.
A flaw was found in capnproto and capnp projects where a specially-crafted pointer could escape bounds checking by exploiting inconsistent handling of pointers when a list-of-structs is downgraded to a list-of-pointers.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-11-28 CVE Reserved
- 2022-11-30 CVE Published
- 2024-06-22 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (8)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Capnproto Search vendor "Capnproto" | Capnproto Search vendor "Capnproto" for product "Capnproto" | < 0.7.1 Search vendor "Capnproto" for product "Capnproto" and version " < 0.7.1" | - |
Affected
| ||||||
| Capnproto Search vendor "Capnproto" | Capnproto Search vendor "Capnproto" for product "Capnproto" | >= 0.9.0 < 0.9.2 Search vendor "Capnproto" for product "Capnproto" and version " >= 0.9.0 < 0.9.2" | - |
Affected
| ||||||
| Capnproto Search vendor "Capnproto" | Capnproto Search vendor "Capnproto" for product "Capnproto" | >= 0.10.0 < 0.10.3 Search vendor "Capnproto" for product "Capnproto" and version " >= 0.10.0 < 0.10.3" | - |
Affected
| ||||||
| Capnproto Search vendor "Capnproto" | Capnproto Search vendor "Capnproto" for product "Capnproto" | 0.8.0 Search vendor "Capnproto" for product "Capnproto" and version "0.8.0" | - |
Affected
| ||||||
| Capnproto Search vendor "Capnproto" | Capnp Search vendor "Capnproto" for product "Capnp" | < 0.13.7 Search vendor "Capnproto" for product "Capnp" and version " < 0.13.7" | rust |
Affected
| ||||||
| Capnproto Search vendor "Capnproto" | Capnp Search vendor "Capnproto" for product "Capnp" | >= 0.14.0 < 0.14.11 Search vendor "Capnproto" for product "Capnp" and version " >= 0.14.0 < 0.14.11" | rust |
Affected
| ||||||
| Capnproto Search vendor "Capnproto" | Capnp Search vendor "Capnproto" for product "Capnp" | >= 0.15.0 < 0.15.2 Search vendor "Capnproto" for product "Capnp" and version " >= 0.15.0 < 0.15.2" | rust |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 36 Search vendor "Fedoraproject" for product "Fedora" and version "36" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 37 Search vendor "Fedoraproject" for product "Fedora" and version "37" | - |
Affected
| ||||||