GHSA-9q78-27f3-2jmh webp crate may expose memory contents when encoding an image
An attacker can trigger out-of-bounds reads in the webp crate by providing a short input buffer, leading to memory exposure or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-9q78-27f3-2jmh?
GHSA-9q78-27f3-2jmh is a memory corruption vulnerability in webp, published on 6 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Affected versions of this crate did not check that the input slice passed to "webp::Encoder::encode() is large enough for the specified image dimensions.
If the input slice is too short, the library will read out of bounds of the buffer and encode other memory contents as an image, resulting in memory exposure or a segmentation fault.
The flaw was corrected in pull request #44 by always validating the input buffer size when constructing the encoder.
Which versions are affected by GHSA-9q78-27f3-2jmh?
3 open source packages ship an affected version, including webp.
| Package | Affected | Fixed in |
|---|---|---|
webp crates.io | All versions | 0.3.1 |
webp crates.io | All versions | 0.3.1 |
webp crates.io | From 0.0.0-0 | 0.3.1 |
How do I fix GHSA-9q78-27f3-2jmh?
Upgrade webp to 0.3.1 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-9q78-27f3-2jmh being exploited?
There is no known exploitation of GHSA-9q78-27f3-2jmh in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2024-0443.