CVE-2023-45679 Attempt to free an uninitialized memory pointer in vorbis_deinit in stb_vorbis

2023-10-2023:26:52

CWE-415

GitHub_M

github.com

cve-2023-45679

vorbis_deinit

memory allocation

code execution

crafted file

stb_vorbis

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in start_decoder. In that case the function returns early, but some of the pointers in f->comment_list are left initialized and later setup_free is called on these pointers in vorbis_deinit. This issue may lead to code execution.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:nothings:stb:*:*:*:*:*:*:*:*"
    ],
    "vendor": "nothings",
    "product": "stb",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.22"
      }
    ],
    "defaultStatus": "unknown"
  }
]