CVE-2021-21401 Invalid free() call in Nanopb

What is CVE-2021-21401?

CVE-2021-21401 is a high-severity memory corruption vulnerability in nanopb, published on 23 Mar 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `oneof` directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field is incorrectly treated as if it was a pointer value. Such message data rarely occurs in normal messages, but it is a concern when untrusted data is parsed. This has been fixed in versions 0.3.9.8 and 0.4.5. See referenced GitHub Security Advisory for more information including workarounds.

Weakness: CWE-763

Which versions are affected by CVE-2021-21401?

5 open source packages ship an affected version, including nanopb. It affects 1 product.

Products include Nanopb Project Nanopb.

How do I fix CVE-2021-21401?

Upgrade nanopb to a fixed version for your release line: 0.3.9.8 or 0.4.5.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-21401 being exploited?

There is no known exploitation of CVE-2021-21401 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in nanopb

• CVE-2014-125106 Integer overflow in n/a Critical 9.8
• CVE-2020-26243 Memory leak in nanopb High 7.5
• CVE-2020-5235 Out-of-memory condition in Nanopb is potentially exploitable Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2021-21401, GHSA-7mv5-5mxh-qg88, PYSEC-2021-432, UBUNTU-CVE-2021-21401.