REDHAT-BUG-2443348: High severity ocaml OCaml vulnerability
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ocamlto a version that resolves this vulnerability.Fixed in 4.14.3 - Upgrade
Upgrade
ocamlto a version that resolves this vulnerability.Fixed in 5.4.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2443348?
The severity of REDHAT-BUG-2443348 is rated high, with a score of 7.
What type of vulnerability is REDHAT-BUG-2443348?
REDHAT-BUG-2443348 is a buffer over-read vulnerability that enables remote code execution.
How do I fix REDHAT-BUG-2443348?
To fix REDHAT-BUG-2443348, you need to upgrade to OCaml version 4.14.3 or above, or to 5.4.1 or higher.
Which versions of OCaml are affected by REDHAT-BUG-2443348?
Versions of OCaml before 4.14.3 and 5.x before 5.4.1 are affected by REDHAT-BUG-2443348.
What is the potential impact of REDHAT-BUG-2443348?
The potential impact of REDHAT-BUG-2443348 includes the risk of remote code execution through a multi-phase attack chain.