CVE-2020-26243 Memory leak in nanopb
Attackers can cause memory leaks in nanopb by sending crafted messages with specific oneof structures, leading to resource exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-26243?
CVE-2020-26243 is a high-severity memory corruption vulnerability in nanopb, published on 25 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed. This is fixed in versions 0.3.9.7 and 0.4.4. The following workarounds are available: 1) Set the option `no_unions` for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code. 2) Set the type of the submessage field inside oneof to `FT_POINTER`. This way the whole submessage will be dynamically allocated and the problematic code is not executed. 3) Use an arena allocator for nanopb, to make sure all memory can be released afterwards.
Which versions are affected by CVE-2020-26243?
5 open source packages ship an affected version, including nanopb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nanopb PyPI | From 0.3.2 | 0.3.9.7, 0.4.4 |
nanopb PyPI | From 0.3.2 | 0.3.9.7 |
nanopb PyPI | From 0.3.2 | 0.3.9.7 |
nanopb PyPI | From 0.4.0 | 0.4.4 |
nanopb PyPI | From 0.4.0 | 0.4.4 |
Products include Nanopb Project Nanopb.
How do I fix CVE-2020-26243?
Upgrade nanopb to a fixed version for your release line: 0.3.9.7 or 0.4.4.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-26243 being exploited?
There is no known exploitation of CVE-2020-26243 in the wild and no public exploit code.
Other vulnerabilities in nanopb
Sources
Also known as DEBIAN-CVE-2020-26243, GHSA-85rr-4rh9-hhwh, PYSEC-2026-684, UBUNTU-CVE-2020-26243.