CVE-2019-12410 Missing Initialization of Resource in Apache Arrow

High 7.5 Published 8 Nov 2019 Updated 4 Aug 2024

Apache Arrow fails to initialize memory when reading RLE null data from Parquet, potentially exposing uninitialized memory to attackers via data transmission or storage.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-12410?

CVE-2019-12410 is a high-severity vulnerability in Apache Arrow, published on 8 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.

Weakness: CWE-909

Which versions are affected by CVE-2019-12410?

5 open source packages ship an affected version, including pyarrow and red-arrow. It affects 1 product.

Package	Affected	Fixed in
`pyarrow` PyPI	From `0.12.0`	`0.15.0`
`pyarrow` PyPI	From `0.12.0`	`0.15.1`
`pyarrow` PyPI	From `0.12.0`	`0.15.1`
`red-arrow` RubyGems	From `0.12.0`	`0.15.1`
`red-arrow` RubyGems	From `0.12.0`	`0.15.1`

Products include Apache Arrow.

How do I fix CVE-2019-12410?

Upgrade pyarrow to a fixed version for your release line: 0.15.0 or 0.15.1.

Is CVE-2019-12410 being exploited?

There is no known exploitation of CVE-2019-12410 in the wild and no public exploit code.

Sources

Also known as GHSA-cjw4-2w9r-r8mv, PYSEC-2019-196.