CVE-2021-21401 (published 2021-03-23T18:15Z)

Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `oneof` directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field is incorrectly treated as if it was a pointer value. Such message data rarely occurs in normal messages, but it is a concern when untrusted data is parsed. This has been fixed in versions 0.3.9.8 and 0.4.5. See referenced GitHub Security Advisory for more information including workarounds.

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:N/I:P/A:P)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L)

Weakness information:
cwe_id: CWE-763
cwe_name: Release of Invalid Pointer or Reference
description: The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
extended_description: 
            This weakness can take several forms, such as:
               
                  The memory was allocated, explicitly or implicitly, via one memory management method and deallocated using a different, non-compatible function (CWE-762).
                  The function calls or memory management routines chosen are appropriate, however they are used incorrectly, such as in CWE-761.
               
         
         

Fix information:
repo_url: https://github.com/nanopb/nanopb
commit_details: repo_url: https://github.com/nanopb/nanopb
author: Petteri Aimonen
author_date: 2021-03-20 09:45:04+02:00
msg: Fix invalid free() with oneof (#647)

Nanopb would call free() or realloc() on an invalid
(attacker controlled) pointer value when all the following
conditions are true:

- PB_ENABLE_MALLOC is defined at the compile time
- Message definition contains an oneof field, and the oneof
  contains at least one pointer type field and at least one
  non-pointer type field.
- Data being decoded first contains a non-pointer value for
  the oneof field, and later contains an overwriting pointer
  value.

Depending on message layout, the bug may not be exploitable in all
cases, but it is known to be exploitable at least with string and
bytes fields. Actual security impact will also depend on the heap
implementation used.
repository: repo_url: https://github.com/nanopb/nanopb
repo_name: nanopb/nanopb
description: Protocol Buffers with small code size
repo_language: C
owner: nanopb
file_changes: filename: pb_decode.c
change_type: ModificationType.MODIFY
diff: @@ -1203,6 +1203,14 @@ static bool pb_release_union_field(pb_istream_t *stream, pb_field_iter_t *field)
 
     pb_release_single_field(&old_field);
 
+    if (PB_ATYPE(field->type) == PB_ATYPE_POINTER)
+    {
+        /* Initialize the pointer to NULL to make sure it is valid
+         * even in case of error return. */
+        *(void**)field->pField = NULL;
+        field->pData = NULL;
+    }
+
     return true;
 }
 

programming_language: C