CVE-2020-23921
📋 TL;DR
CVE-2020-23921 is a heap-based buffer over-read vulnerability in fast_ber's ASN.1 compiler. This allows attackers to read memory beyond allocated buffers, potentially exposing sensitive information or causing crashes. Users of applications that incorporate fast_ber library versions through v0.4 are affected.
💻 Affected Systems
- fast_ber library
📦 What is this software?
Fast Ber by Fast Ber Project
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure of sensitive memory contents, potential remote code execution through memory corruption, or denial of service through application crashes.
Likely Case
Application crashes leading to denial of service, or information leakage of adjacent memory contents.
If Mitigated
Limited impact with proper memory protections (ASLR, DEP) and sandboxing, potentially just crashes without data exposure.
🎯 Exploit Status
Exploitation requires crafting malicious ASN.1 data that triggers the buffer over-read. No public exploits have been documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after v0.4
Vendor Advisory: https://github.com/Samuel-Tyler/fast_ber/issues/30
Restart Required: Yes
Instructions:
1. Update fast_ber library to version after v0.4. 2. Recompile any applications using fast_ber. 3. Restart affected services.
🔧 Temporary Workarounds
Disable ASN.1 compiler functionality
allIf possible, disable or avoid using the ASN.1 compiler component of fast_ber.
🧯 If You Can't Patch
- Implement strict input validation for ASN.1 data processed by fast_ber
- Deploy memory protection mechanisms (ASLR, DEP) and sandbox applications using fast_ber
🔍 How to Verify
Check if Vulnerable:
Check if application uses fast_ber library version 0.4 or earlier. Review source code for inclusion of asn_compiler.hpp.Check Version:
Check build configuration or package manager for fast_ber version (e.g., 'dpkg -l | grep fast_ber' on Debian-based systems)Verify Fix Applied:
Verify fast_ber library version is after v0.4 and check that the updated code no longer contains the vulnerable yy::yylex() implementation.📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults or memory access errors
- Unexpected termination of services using fast_ber
Network Indicators:
- Unusual ASN.1 data patterns sent to services using fast_ber
SIEM Query:
search 'segmentation fault' OR 'memory violation' AND process_name contains 'fast_ber'