CVE-2018-7166: High severity Nodejs Node.js vulnerability
In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause Buffer.alloc() to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying encoding can be passed as a number, this is misinterpreted by Buffer's internal "fill" method as the start to a fill operation. This flaw may be abused where Buffer.alloc() arguments are derived from user input to return uncleared memory blocks that may contain sensitive information.
Other sources
Node.js TSC member Сковорода Никита Андреевич (Nikita Skovoroda / @ChALkeR) discovered an argument processing flaw that causes Buffer.alloc() to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying encoding can be passed as a number, this is misinterpreted by Buffer's internal "fill" method as the start to a fill operation. This flaw may be abused where Buffer.alloc() arguments are derived from user input to return uncleared memory blocks that may contain sensitive information.
Impact:
All versions of Node.js 6.x (LTS "Boron") are NOT vulnerable All versions of Node.js 8.x (LTS "Carbon") are NOT vulnerable All previous versions of Node.js 10.x (Current) are vulnerable
References:
https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 10.9.0 - Upgrade
Upgrade
nodejsto a version that resolves this vulnerability.Fixed in 10.9.0
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7166?
CVE-2018-7166 is considered a critical vulnerability due to the potential exposure of sensitive data through uninitialized memory.
How do I fix CVE-2018-7166?
To fix CVE-2018-7166, upgrade Node.js to version 10.9.0 or later.
Which versions of Node.js are affected by CVE-2018-7166?
CVE-2018-7166 affects all versions of Node.js prior to 10.9.0.
What vulnerability type is CVE-2018-7166?
CVE-2018-7166 is categorized as an argument processing flaw in the Node.js Buffer module.
Can CVE-2018-7166 lead to data exposure?
Yes, CVE-2018-7166 can lead to data exposure due to the returning of uninitialized memory.