CVE-2023-45677 Heap buffer out of bounds write in start_decoder in stb_vorbis

High 7.3 Published 20 Oct 2023 Updated 12 Sep 2024

A crafted Ogg Vorbis file can trigger a heap buffer overflow in stb_vorbis, potentially allowing arbitrary code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-45677?

CVE-2023-45677 is a high-severity memory corruption vulnerability in nothings stb, published on 20 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if `len` read in `start_decoder` is a negative number and `setup_malloc` successfully allocates memory in that case, but memory write is done with a negative index `len`. Similarly if len is INT_MAX the integer overflow len+1 happens in `f->vendor = (char*)setup_malloc(f, sizeof(char) * (len+1));` and `f->comment_list[i] = (char*)setup_malloc(f, sizeof(char) * (len+1));`. This issue may lead to code execution.

Weakness: CWE-787

Which versions are affected by CVE-2023-45677?

It affects 1 product.

Products include Nothings Stb Vorbis.c.

How do I fix CVE-2023-45677?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-45677 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-45677 exists.

Sources

Also known as DEBIAN-CVE-2023-45677, UBUNTU-CVE-2023-45677.