CVE-2021-21401
Nanopb is a small code-size Protocol Buffers implementation in ansi C.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.81%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `oneof` directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field is incorrectly treated as if it was a pointer value. Such message data rarely occurs in normal messages, but it is a concern when untrusted data is parsed. This has been fixed in versions 0.3.9.8 and 0.4.5. See referenced GitHub Security Advisory for more information including workarounds.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
- EPSS
- 1.81% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-763
- Affected
- nanopb project/nanopb
- Source
- security-advisories@github.com
References
- https://github.com/nanopb/nanopb/blob/c9124132a604047d0ef97a09c0e99cd9bed2c818/CHANGELOG.txt#L1Release Notes, Third Party Advisory
- https://github.com/nanopb/nanopb/commit/e2f0ccf939d9f82931d085acb6df8e9a182a4261Patch, Third Party Advisory
- https://github.com/nanopb/nanopb/issues/647Exploit, Issue Tracking, Third Party Advisory
- https://github.com/nanopb/nanopb/security/advisories/GHSA-7mv5-5mxh-qg88Exploit, Patch, Third Party Advisory
- https://github.com/nanopb/nanopb/blob/c9124132a604047d0ef97a09c0e99cd9bed2c818/CHANGELOG.txt#L1Release Notes, Third Party Advisory
- https://github.com/nanopb/nanopb/commit/e2f0ccf939d9f82931d085acb6df8e9a182a4261Patch, Third Party Advisory
- https://github.com/nanopb/nanopb/issues/647Exploit, Issue Tracking, Third Party Advisory
- https://github.com/nanopb/nanopb/security/advisories/GHSA-7mv5-5mxh-qg88Exploit, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.