Use after free in C++ protobuf
CVE-2024-2410

9.8CRITICAL

Key Information:

Vendor

Protocolbuffers

Status
Protobuf
Vendor
CVE Published:
3 May 2024

What is CVE-2024-2410?

The memory corruption vulnerability affects the JsonToBinaryStream() function within the Protocol Buffers C++ implementation. This vulnerability arises when JSON input is fragmented into separate chunks in a specific manner, causing the parser to attempt to access memory locations that have already been deallocated. This situation could lead to unexpected behavior or application crashes, posing risks to data integrity and application stability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

protobuf 4.22.0 < 4.25.0

References

https://github.com/protocolbuffers/protobuf/releases/tag/...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.