GitHub Security Advisory: GHSA-qqff-4vw4-f6hx
Package: capnp (RUST)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 0.13.7
Patched in: 0.13.7

Summary: Cap'n Proto and its Rust implementation vulnerable to out-of-bounds read due to logic error handling list-of-list

Details:
The Cap'n Proto library and capnp Rust package are vulnerable to out-of-bounds read due to logic error handling list-of-list. If a message consumer expects data of type "list of pointers", and if the consumer performs certain specific actions on such data, then a message producer can cause the consumer to read out-of-bounds memory. This could trigger a process crash in the consumer, or in some cases could allow exfiltration of private in-memory data.

Impact
======

- Remotely segfault a peer by sending it a malicious message, if the victim performs certain actions on a list-of-pointer type.
- Possible exfiltration of memory, if the victim performs additional certain actions on a list-of-pointer type.
- To be vulnerable, an application must perform a specific sequence of actions, described below. At present, **we are not aware of any vulnerable application**, but we advise updating regardless.

Fixed in
========

Unfortunately, the bug is present in inlined code, therefore the fix will require rebuilding dependent applications.

C++ fix:

- git commit [25d34c67863fd960af34fc4f82a7ca3362ee74b9][0]
- release 0.11 (future)
- release 0.10.3:
  - Unix: https://capnproto.org/capnproto-c++-0.10.3.tar.gz
  - Windows: https://capnproto.org/capnproto-c++-win32-0.10.3.zip
- release 0.9.2:
  - Unix: https://capnproto.org/capnproto-c++-0.9.2.tar.gz
  - Windows: https://capnproto.org/capnproto-c++-win32-0.9.2.zip
- release 0.8.1:
  - Unix: https://capnproto.org/capnproto-c++-0.8.1.tar.gz
  - Windows: https://capnproto.org/capnproto-c++-win32-0.8.1.zip
- release 0.7.1:
  - Unix: https://capnproto.org/capnproto-c++-0.7.1.tar.gz
  - Windows: https://capnproto.org/capnproto-c++-win32-0.7.1.zip
- release 0.5.4:
  - Unix: https://capnproto.org/capnproto-c++-0.5.4.tar.gz
  - Windows: https://capnproto.org/capnproto-c++-win32-0.5.4.zip

Rust fix:

- `capnp` crate version `0.15.2`, `0.14.11`, or `0.13.7`

[0]: https://github.com/capnproto/capnproto/commit/25d34c67863fd960af34fc4f82a7ca3362ee74b9

Details
=======

A specially-crafted pointer could escape bounds checking by exploiting inconsistent handling of pointers when a list-of-structs is downgraded to a list-of-pointers.

For an in-depth explanation of how this bug works, see [David Renshaw's blog post](https://dwrensha.github.io/capnproto-rust/2022/11/30/out_of_bounds_memory_access_bug.html). This details below focus only on determining whether an application is vulnerable.

In order to be vulnerable, an application must have certain properties.

First, the application must accept messages with a schema in which a field has list-of-pointer type. This includes `List(Text)`, `List(Data)`, `List(List(T))`, or `List(C)` where `C` is an interface type. In the following discussion, we will assume this field is named `foo`.

Second, the application must accept a message of this schema from a malicious source, where the attacker can maliciously encode the pointer representing the field `foo`.

Third, the application must