Buffer Overflow in libwebsockets via LEJP JSON Parser

Executive Summary

This is a Buffer Overflow vulnerability in the libwebsockets library, specifically in the main branch version 106d542c. It involves the LEJP JSON parser, which can be exploited by a remote attacker to cause a denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems running libwebsockets versions before the patched commits. Check for crashes when parsing deeply nested JSON (e.g., 92+ bytes of nested '[' characters). Use sanitizer builds to catch memory corruption. Monitor logs for SIGILL crashes or memory corruption errors during JSON parsing.

Useful 0 Not Useful 0

Impact Analysis

A remote attacker could exploit this flaw to crash the application or service using the vulnerable libwebsockets version, leading to service disruption or downtime.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a technical implementation issue in a JSON parser library. However, if exploited, it could lead to denial of service or memory corruption in systems processing JSON data, potentially disrupting services that handle personal or health data. Compliance impact would depend on how the affected library is used in systems subject to these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update libwebsockets to a version containing commits 736a4a2 or c404a20. If updating is not possible, restrict input to trusted JSON parsers or limit JSON nesting depth. Disable affected services if they process untrusted JSON until patched.

Useful 0 Not Useful 0