CVE-2024-2410

2024-05-0300:00:00

ubuntu.com

jsontobinarystream

protocol buffers

c++

parse json

stream

freed bytes

cve-2024-2410

bug introduced

CVSS3

7.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

AI Score

7.5

Confidence

High

EPSS

Percentile

9.0%

JSON

The JsonToBinaryStream() function is part of the protocol buffers C++
implementation and is used to parse JSON from a stream. If the input is
broken up into separate chunks in a certain way, the parser will attempt to
read bytes from a chunk that has already been freed.