Out-of-Bounds Read in zstd-jni Java Library

Executive Summary

zstd-jni versions 1.2.0 through 1.5.7-13 have an out-of-bounds read flaw in the ZstdDictDecompress constructor. The issue occurs because the constructor does not validate the offset and length arguments against the dictionary array bounds. Attackers can exploit this by providing arbitrary values, causing the JVM to read memory beyond the array's end and potentially crash.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of zstd-jni in your Java environment. Use commands like 'mvn dependency:tree' for Maven projects or 'gradle dependencies' for Gradle projects to inspect the library version. If the version is between 1.2.0 and 1.5.7-13, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to crash the Java Virtual Machine (JVM) by triggering an out-of-bounds read. In some cases, it might also leak sensitive heap memory into dictionary state if the read stays within mapped memory. This could lead to denial-of-service conditions or unauthorized information exposure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through JVM termination or unauthorized memory access. Out-of-bounds reads may lead to crashes or data leaks, violating availability and confidentiality requirements in these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade zstd-jni to version 1.5.7-14 or later, which includes bounds validation for offset and length parameters. Remove or replace any vulnerable versions from your project dependencies immediately.

Useful 0 Not Useful 0