CVE-2017-7892
HighSummary
Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can trigger a segfault in a 32-bit libcapnp application due to overflow in pointer arithmetic calculations.
Risk Assessment
An attacker can exploit this vulnerability to remotely crash the application, potentially leading to service downtime.
Recommendation
It is recommended to upgrade to Cap'n Proto version 0.5.3.1 or later to mitigate this vulnerability.
Other vulnerabilities in Sandstorm Cap'n Proto
See all- CVE-2015-2313High
In Sandstorm Cap'n Proto versions before 0.4.1.1 and 0.5.x before 0.5.1.2, the totalSize method on an object reader can be exploited by remote peers to cause a denial of service through a crafted small message, leading to high CPU consumption.
- CVE-2015-2312High
Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service via a list with a large number of elements.
- CVE-2015-2311Critical
An integer underflow in Sandstorm Cap'n Proto before version 0.4.1.1 and 0.5.x before 0.5.1.1 may allow remote peers to cause a denial of service or potentially obtain sensitive information from memory or execute arbitrary code via a crafted message.
- CVE-2015-2310Critical
Integer overflow in layout.c++ in Sandstorm Cap'n Proto before version 0.4.1.1 and 0.5.x before version 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive information from memory via a crafted message, related to pointer validation.
Original NVD description (English source)
Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can trigger a segfault in a 32-bit libcapnp application because Cap'n Proto relies on pointer arithmetic calculations that overflow. An example compiler with optimization that elides a bounds check in such calculations is Apple LLVM version 8.1.0 (clang-802.0.41). The attack vector is a crafted far pointer within a message.