CVE-2017-7892 Integer overflow in n/a
Remote attackers can cause denial of service in 32-bit Cap'n Proto applications via crafted messages triggering integer overflows and segfaults.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-7892?
CVE-2017-7892 is a high-severity vulnerability in n/a, published on 17 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can trigger a segfault in a 32-bit libcapnp application because Cap'n Proto relies on pointer arithmetic calculations that overflow. An example compiler with optimization that elides a bounds check in such calculations is Apple LLVM version 8.1.0 (clang-802.0.41). The attack vector is a crafted far pointer within a message.
Weakness: CWE-20
Which versions are affected by CVE-2017-7892?
It affects 1 product.
Products include Capnproto Capnproto.
How do I fix CVE-2017-7892?
Upgrade to a fixed version.
Is CVE-2017-7892 being exploited?
There is no known exploitation of CVE-2017-7892 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2017-7892, GHSA-q5jr-ph84-c3r5, UBUNTU-CVE-2017-7892.