CVE-2019-16224
📋 TL;DR
CVE-2019-16224 is a critical memory corruption vulnerability in py-lmdb 0.97 that allows attackers to execute arbitrary code or cause denial of service by supplying a malicious data.mdb file. The vulnerability stems from improper memory handling in the mdb_node_add function when processing certain md_flags values. Any application using the vulnerable py-lmdb library to process untrusted LMDB database files is affected.
💻 Affected Systems
- py-lmdb
📦 What is this software?
Py Lmdb by Py Lmdb Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the application processing the malicious LMDB file, potentially leading to complete system compromise.
Likely Case
Application crash and denial of service, with potential for information disclosure or limited code execution depending on memory layout.
If Mitigated
Denial of service only if memory protections prevent code execution, but application availability is still impacted.
🎯 Exploit Status
Public proof-of-concept demonstrates exploitation. Attack requires supplying a malicious data.mdb file to the vulnerable application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: py-lmdb 0.98 and later
Vendor Advisory: https://github.com/jnwatson/py-lmdb/issues/167
Restart Required: Yes
Instructions:
1. Identify applications using py-lmdb. 2. Update py-lmdb to version 0.98 or later using pip: 'pip install --upgrade lmdb'. 3. Restart all applications using the library.
🔧 Temporary Workarounds
Input validation for LMDB files
allImplement strict validation of LMDB files before processing, rejecting files from untrusted sources.
Application sandboxing
allRun applications using py-lmdb in restricted environments with limited privileges.
🧯 If You Can't Patch
- Implement network segmentation to isolate systems using vulnerable py-lmdb versions
- Deploy application allowlisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check py-lmdb version with: 'python -c "import lmdb; print(lmdb.__version__)"' - if output is '0.97', system is vulnerable.Check Version:
python -c "import lmdb; print(lmdb.__version__)"Verify Fix Applied:
After update, verify version is 0.98 or higher using same command.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected termination of processes using py-lmdb
Network Indicators:
- Unexpected LMDB file transfers to vulnerable systems
SIEM Query:
source="application_logs" AND ("segmentation fault" OR "memory corruption" OR "invalid write") AND process="*lmdb*"