CVE-2023-34453: snappy-java's Integer Overflow vulnerability in shuffle leads to DoS

Vulnerability summary

CVE-2023-34453 is a high (CVSS 7.5) Integer Overflow or Wraparound vulnerability in xerial snappy-java. EPSS estimates a 1.71% chance of exploitation in the next 30 days, higher than 77.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-06-2023
   PublishedVulnerability first disclosed.
2. 12-12-2024
   Last modifiedVulnerability information updated.

Description

snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing a fatal error. The function `shuffle(int[] input)` in the file `BitShuffle.java` receives an array of integers and applies a bit shuffle on it. It does so by multiplying the length by 4 and passing it to the natively compiled shuffle function. Since the length is not tested, the multiplication by four can cause an integer overflow and become a smaller value than the true size, or even zero or negative. In the case of a negative value, a `java.lang.NegativeArraySizeException` exception will raise, which can crash the program. In a case of a value that is zero or too small, the code that afterwards references the shuffled array will assume a bigger size of the array, which might cause exceptions such as `java.lang.ArrayIndexOutOfBoundsException`. The same issue exists also when using the `shuffle` functions that receive a double, float, long and short, each using a different multiplier that may cause the same issue. Version 1.1.10.1 contains a patch for this vulnerability.

• CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.