CVE-2023-6992: cloudflare zlib Improper Input Validation

Vulnerability summary

CVE-2023-6992 is a medium (CVSS 5.5) Improper Input Validation vulnerability in cloudflare zlib. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.5% of scored vulnerabilities.

Timeline

1. 04-01-2024
   PublishedVulnerability first disclosed.
2. 06-09-2024
   Last modifiedVulnerability information updated.

Description

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
• CWE-126Buffer Over-readThe product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.