CVE-2021-3520 (Critical) detected in https://source.codeaurora.org/quic/la/platform/external/lz4/android-t-preview-2 - autoclosed

[mend-for-github-com]

CVE-2021-3520 - Critical Severity Vulnerability

Vulnerable Library - https://source.codeaurora.org/quic/la/platform/external/lz4/android-t-preview-2

Library home page: https://source.codeaurora.org/quic/la/platform/external/lz4/

Found in base branch: main

Vulnerable Source Files (1)

/node_modules/lmdb/dependencies/lz4/lib/lz4.c

Vulnerability Details

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

Publish Date: 2021-06-02

URL: CVE-2021-3520

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://rustsec.org/advisories/RUSTSEC-2022-0051.html

Release Date: 2021-06-02

Fix Resolution: lz4-sys 1.9.4

[ananzh]

In node_modules/lmdb, I only see

node_modules/@lmdb/lmdb-linux-x64/index.js
node_modules/@lmdb/lmdb-linux-x64/node.abi93.glibc.node
node_modules/@lmdb/lmdb-linux-x64/node.abi108.glibc.node
node_modules/@lmdb/lmdb-linux-x64/node.abi115.glibc.node
node_modules/@lmdb/lmdb-linux-x64/node.napi.glibc.node
node_modules/@lmdb/lmdb-linux-x64/node.napi.musl.node

These are various precompiled binaries for the LMDB library on Linux, built against different Node.js ABI versions and glibc/musl C libraries. They are the native components of LMDB and don't seem to include the lz4 compression library directly.

I also checked our lmdb usage (packages/osd-optimizer/src/node/cache.ts). Seems to me that we do not utilize lz4 directly or through LMDB, then we should not be impacted by this specific vulnerability.

@AMoo-Miki should we close this security issue?

[ananzh]

I am wrong. Issue is for node_modules/lmdb not node_modules/@LMDB
Seems there is a PR fixing the security issue last week kriszyp/lmdb-js#255 and
kriszyp/lmdb-js@8bcbcaf

[ananzh]

@szhongna Since you are on-call this week, could you follow up on this? Once there is a release, we could start bump the package. If no release this week, just pass to next week on-call. Thanks.

[zhongnansu]

there's a new release published https://www.npmjs.com/package/lmdb, I'll bump the dependency version for OSD

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.