CVE-2017-7892: Input Validation
Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can trigger a segfault in a 32-bit libcapnp application because Cap'n Proto relies on pointer arithmetic calculations that overflow. An example compiler with optimization that elides a bounds check in such calculations is Apple LLVM version 8.1.0 (clang-802.0.41). The attack vector is a crafted far pointer within a message.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sandstorm Cap'n Prototo a version that resolves this vulnerability.Fixed in 0.5.3.1 - Compensating control
For affected 32-bit environments, mitigate remote crash risk by avoiding compiler configurations/optimizations like Apple LLVM version 8.1.0 (clang-802.0.41) that can elide a bounds check during pointer arithmetic overflow handling.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7892?
CVE-2017-7892 is considered a high severity vulnerability due to the potential for remote crashes.
How do I fix CVE-2017-7892?
To fix CVE-2017-7892, upgrade Cap'n Proto to version 0.5.3.1 or later.
What types of applications are affected by CVE-2017-7892?
CVE-2017-7892 affects 32-bit libcapnp applications that use Cap'n Proto versions up to and including 0.5.3.
Can CVE-2017-7892 be exploited remotely?
Yes, CVE-2017-7892 can be exploited remotely by an attacker to trigger a segmentation fault.
What causes the vulnerability in CVE-2017-7892?
CVE-2017-7892 is caused by pointer arithmetic calculations that overflow due to compiler optimizations.