GLSA 202406-04: LZ4: Memory Corruption

http://security.gentoo.org/

Severity:	normal
Title:	LZ4: Memory Corruption
Date:	06/22/2024
Bugs:	#791952
ID:	202406-04

Synopsis

A vulnerability has been discovered in LZ4, which can lead to memory corruption.

Background

LZ4 is a lossless compression algorithm, providing compression speed > 500 MB/s per core, scalable with multi-cores CPU. It features an extremely fast decoder, with speed in multiple GB/s per core, typically reaching RAM speed limits on multi-core systems.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
app-arch/lz4	< 1.9.3-r1	>= 1.9.3-r1	All supported architectures

Description

An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash.

Impact

The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

Workaround

There is no known workaround at this time.

Resolution

All LZ4 users should upgrade to the latest version:

          # emerge --sync
          # emerge --ask --oneshot --verbose ">=app-arch/lz4-1.9.3-r1"

References

CVE-2021-3520

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-202406-04.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.