Summary

Out-of-bounds Write vulnerability in the bundled Brotli decoder in yjh0502 erl-brotli allows an attacker who supplies a crafted Brotli-compressed stream to brotli:decode/1 to corrupt decoder state memory, disclose memory contents, crash the Erlang VM, or potentially execute code.

erl-brotli compiles its own copy of the Google Brotli C sources under csrc into a NIF, and brotlidecoderdecompressstream in csrc/brotlinif.c hands the input to BrotliDecoderDecompressStream. In csrc/dec/decode.c, DecodeBlockTypeAndLength returns false for a block switch in a category with at most one block type, and the non-streaming callers DecodeLiteralBlockSwitch, DecodeCommandBlockSwitch and DecodeDistanceBlockSwitch discard that result, so decoding continues with inconsistent state. The decoder runs inside a NIF, so memory corruption or a crash takes down the whole VM rather than the calling process. Because the package carries its own copy of the library, the Brotli version installed on the host does not matter.

This issue affects brotli: from 0.3.0 before 0.3.4.

Impact

An attacker who can get an application to decode a Brotli stream they control, for example an HTTP client that decompresses Content-Encoding: br responses with this package, can crash the Erlang VM and potentially run code inside it.

Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.

Improper authorization in Windows FTP Service allows an authorized attacker to elevate privileges locally.

Active Directory Domain Services Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows TPM allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network.

Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.

Time-of-check time-of-use (toctou) race condition in Windows Security Account Manager allows an unauthorized attacker to bypass a security feature over a network.

Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Windows Maps allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Windows iSCSI allows an unauthorized attacker to elevate privileges over a network.

Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows SMB allows an authorized attacker to execute code over a network.

Heap-based buffer overflow in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

Improper link resolution before file access ('link following') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.

Microsoft Trace Data Helper Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to execute code over a network.

Insufficient granularity of access control in Windows IKE Extension allows an authorized attacker to perform spoofing locally.

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack.

Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.

Stack-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network.

Double free in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.

Integer underflow (wrap or wraparound) in Windows Update Stack allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

Use after free in Windows Filter Manager allows an authorized attacker to elevate privileges locally.