CVE-2023-34454

一、漏洞信息
 漏洞编号：[CVE-2023-34454](https://nvd.nist.gov/vuln/detail/CVE-2023-34454)
 漏洞归属组件：[snappy-java](https://gitee.com/src-openeuler/snappy-java)
 漏洞归属的版本：1.1.2.4,1.1.8.4
 CVSS V3.0分值：
  BaseScore：7.5 High
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing an unrecoverable fatal error.The function `compress(char[] input)` in the file `Snappy.java` receives an array of characters and compresses it. It does so by multiplying the length by 2 and passing it to the rawCompress` function.Since the length is not tested, the multiplication by two can cause an integer overflow and become negative. The rawCompress function then uses the received length and passes it to the natively compiled maxCompressedLength function, using the returned value to allocate a byte array.Since the maxCompressedLength function treats the length as an unsigned integer, it doesn’t care that it is negative, and it returns a valid value, which is casted to a signed integer by the Java engine. If the result is negative, a `java.lang.NegativeArraySizeException` exception will be raised while trying to allocate the array `buf`. On the other side, if the result is positive, the `buf` array will successfully be allocated, but its size might be too small to use for the compression, causing a fatal Access Violation error.The same issue exists also when using the `compress` functions that receive double, float, int, long and short, each using a different multiplier that may cause the same issue. The issue most likely won’t occur when using a byte array, since creating a byte array of size 0x80000000 (or any other negative value) is impossible in the first place.Version 1.1.10.1 contains a patch for this issue.
 漏洞公开时间：2023-06-16 01:15:00
 漏洞创建时间：2023-06-16 10:06:47
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-34454
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://github.com/xerial/snappy-java/blob/05c39b2ca9b5b7b39611529cc302d3d796329611/src/main/java/org/xerial/snappy/Snappy.java#L169 |  |
| nvd | https://github.com/xerial/snappy-java/blob/05c39b2ca9b5b7b39611529cc302d3d796329611/src/main/java/org/xerial/snappy/Snappy.java#L422 |  |
| nvd | https://github.com/xerial/snappy-java/blob/master/src/main/java/org/xerial/snappy/Snappy.java |  |
| nvd | https://github.com/xerial/snappy-java/security/advisories/GHSA-fjpj-2g6w-x25r |  |
| nvd | https://github.com/xerial/snappy-java/commit/d0042551e4a3509a725038eb9b2ad1f683674d94 |  |
| redhat | https://access.redhat.com/security/cve/CVE-2023-34454 |  |
| github_advisory | https://github.com/xerial/snappy-java/blob/05c39b2ca9b5b7b39611529cc302d3d796329611/src/main/java/org/xerial/snappy/Snappy.java#L169 | https://github.com/advisories/GHSA-fjpj-2g6w-x25r |
| github_advisory | https://github.com/xerial/snappy-java/security/advisories/GHSA-fjpj-2g6w-x25r | https://github.com/advisories/GHSA-fjpj-2g6w-x25r |
| github_advisory | https://github.com/xerial/snappy-java/commit/d0042551e4a3509a725038eb9b2ad1f683674d94 | https://github.com/advisories/GHSA-fjpj-2g6w-x25r |
| github_advisory | https://github.com/xerial/snappy-java/blob/master/src/main/java/org/xerial/snappy/Snappy.java | https://github.com/advisories/GHSA-fjpj-2g6w-x25r |
| github_advisory | https://github.com/xerial/snappy-java/blob/05c39b2ca9b5b7b39611529cc302d3d796329611/src/main/java/org/xerial/snappy/Snappy.java#L422 | https://github.com/advisories/GHSA-fjpj-2g6w-x25r |
| osv | https://github.com/xerial/snappy-java/security/advisories/GHSA-fjpj-2g6w-x25r | https://osv.dev/vulnerability/GHSA-fjpj-2g6w-x25r |
| osv | https://github.com/xerial/snappy-java/commit/d0042551e4a3509a725038eb9b2ad1f683674d94 | https://osv.dev/vulnerability/GHSA-fjpj-2g6w-x25r |
| osv | https://github.com/xerial/snappy-java | https://osv.dev/vulnerability/GHSA-fjpj-2g6w-x25r |
| osv | https://github.com/xerial/snappy-java/blob/05c39b2ca9b5b7b39611529cc302d3d796329611/src/main/java/org/xerial/snappy/Snappy.java#L169 | https://osv.dev/vulnerability/GHSA-fjpj-2g6w-x25r |
| osv | https://github.com/xerial/snappy-java/blob/05c39b2ca9b5b7b39611529cc302d3d796329611/src/main/java/org/xerial/snappy/Snappy.java#L422 | https://osv.dev/vulnerability/GHSA-fjpj-2g6w-x25r |
| osv | https://github.com/xerial/snappy-java/blob/master/src/main/java/org/xerial/snappy/Snappy.java | https://osv.dev/vulnerability/GHSA-fjpj-2g6w-x25r |
| nvd | https://github.com/xerial/snappy-java/blob/05c39b2ca9b5b7b39611529cc302d3d796329611/src/main/java/org/xerial/snappy/Snappy.java#L169 |  |
| nvd | https://github.com/xerial/snappy-java/blob/05c39b2ca9b5b7b39611529cc302d3d796329611/src/main/java/org/xerial/snappy/Snappy.java#L422 |  |
| nvd | https://github.com/xerial/snappy-java/blob/master/src/main/java/org/xerial/snappy/Snappy.java |  |
| nvd | https://github.com/xerial/snappy-java/security/advisories/GHSA-fjpj-2g6w-x25r |  |
| nvd | https://github.com/xerial/snappy-java/commit/d0042551e4a3509a725038eb9b2ad1f683674d94 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/xerial/snappy-java/commit/d0042551e4a3509a725038eb9b2ad1f683674d94 |  | nvd |
|  |  | https://github.com/xerial/snappy-java/commit/d0042551e4a3509a725038eb9b2ad1f683674d94 |  | github_advisory |
|  |  | https://github.com/xerial/snappy-java/commit/d0042551e4a3509a725038eb9b2ad1f683674d94 |  | osv |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
      snappy-java 是 Java 的快速压缩器/解压缩器。由于未经检查的乘法，1.1.10.1之前的版本可能会出现整数溢出，从而导致不可恢复的致命错误。Snappy.java文件中的函数compress(char[] input)接收字符数组并对其进行压缩。它通过将长度乘以 2 并将其传递给 rawCompress 函数来实现此目的。由于未测试长度，因此乘以 2 可能会导致整数溢出并变为负值。然后 rawCompress 函数使用接收到的长度并将其传递给本机编译的 maxCompressedLength 函数，使用返回值分配一个字节数组。由于 maxCompressedLength 函数将长度视为无符号整数，因此它不关心它是否为负数，它返回一个有效值，该值由 Java 引擎转换为有符号整数。如果结果为负，则在尝试分配 arraybuf 时将引发 java.lang.NegativeArraySizeException 异常。另一方面，如果结果为正，则 bufarray 将成功分配，但其大小可能太小而无法用于压缩，从而导致致命的访问冲突错误。使用接收的 compress` 函数时也存在同样的问题double、float、int、long 和short，每种都使用不同的乘数，可能会导致相同的问题。使用字节数组时很可能不会出现此问题，因为首先不可能创建大小为 0x80000000（或任何其他负值）的字节数组。版本 1.1.10.1 包含针对此问题的补丁。  
 openEuler评分：
  7.5
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(1.1.2.4):受影响
2.openEuler-20.03-LTS-SP3(1.1.2.4):受影响
3.openEuler-22.03-LTS(1.1.2.4):受影响
4.openEuler-22.03-LTS-SP1(1.1.2.4):受影响
5.openEuler-22.03-LTS-SP2:受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(1.1.2.4):否
2.openEuler-20.03-LTS-SP3(1.1.2.4):否
3.openEuler-22.03-LTS(1.1.2.4):否
4.openEuler-22.03-LTS-SP1(1.1.2.4):否
5.openEuler-22.03-LTS-SP2:否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2023-1398

src-openEuler/snappy-java
关闭

内容风险标识

评论 (11)

src-openEuler/snappy-java关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-34454

评论 (11)

搜索帮助

src-openEuler/snappy-java
关闭