CVE-2023-28445 Deno improperly handles resizable ArrayBuffer
Out-of-bound read/write in Deno via resizable ArrayBuffers allows potential code execution or crashes, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-28445?
CVE-2023-28445 is a critical memory corruption vulnerability in denoland deno, published on 23 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0. Deno Deploy users are not affected. The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. Deno 1.32.2 will re-enable resizable ArrayBuffers with a proper fix. As a workaround, run with `--v8-flags=--no-harmony-rab-gsab` to disable resizable ArrayBuffers.
Which versions are affected by CVE-2023-28445?
6 open source packages ship an affected version, including Deno, deno_runtime and serde_v8. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
Deno crates.io | From 1.32.0 | 1.32.1 |
Deno crates.io | From 1.32.0 | 1.32.1 |
deno_runtime crates.io | From 0.102.0 | 0.103.0 |
deno_runtime crates.io | From 0.102.0 | 0.103.0 |
serde_v8 crates.io | From 0.87.0 | 0.88.0 |
serde_v8 crates.io | From 0.87.0 | 0.88.0 |
Products include Deno Deno, Deno Deno Runtime, Deno Serde V8.
How do I fix CVE-2023-28445?
Upgrade Deno to 1.32.1 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-28445 being exploited?
There is no known exploitation of CVE-2023-28445 in the wild and no public exploit code.
Other vulnerabilities in denoland deno
- CVE-2022-24783 Sandbox bypass leading to arbitrary code execution in Deno
- CVE-2021-32619 Static imports inside dynamically imported modules do not adhere to permission checks
- CVE-2026-22863 Deno node:crypto doesn't finalize cipher
- CVE-2024-27936 Deno interactive permission prompt spoofing via improper ANSI stripping
- CVE-2023-28446 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization
Sources
Also known as GHSA-c25x-cm9x-qqgx.