CVE-2023-37185
📋 TL;DR
CVE-2023-37185 is a NULL pointer dereference vulnerability in c-blosc2's zfp_prec_decompress function that can cause denial of service (crash) when processing malicious compressed data. This affects applications using c-blosc2 library versions before 2.9.3 for data compression/decompression. The vulnerability requires processing untrusted input to trigger.
💻 Affected Systems
- c-blosc2 library
- Applications using c-blosc2 for compression
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Application crash leading to denial of service, potentially disrupting dependent services or causing data loss if crash occurs during critical operations.
Likely Case
Application crash when processing malicious or malformed compressed data, resulting in temporary service unavailability.
If Mitigated
Minimal impact if proper input validation and error handling are implemented, though crashes may still occur.
🎯 Exploit Status
Exploitation requires ability to provide malicious compressed data to vulnerable function; no authentication needed if application accepts external input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.3
Vendor Advisory: https://github.com/Blosc/c-blosc2/commit/425e8a9a59d49378d57e2116b6c9b0190a5986f5
Restart Required: Yes
Instructions:
1. Update c-blosc2 to version 2.9.3 or later. 2. Recompile applications using c-blosc2. 3. Restart affected services. 4. Verify the fix by checking version and testing with known safe data.
🔧 Temporary Workarounds
Disable zfp compression
allDisable zfp compression backend if not required, using alternative compression methods.
Configure applications to use blosclz, lz4, or zstd instead of zfp
Input validation
allImplement strict input validation for compressed data before passing to c-blosc2.
🧯 If You Can't Patch
- Implement network segmentation to limit access to services using c-blosc2
- Deploy application-level firewalls to filter suspicious compressed data inputs
🔍 How to Verify
Check if Vulnerable:
Check c-blosc2 version: if version < 2.9.3 and zfp compression is used, system is vulnerable.Check Version:
Check library version in application or use: pkg-config --modversion c-blosc2 (if installed)Verify Fix Applied:
Verify c-blosc2 version is 2.9.3 or later and test decompression with various inputs.📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Error logs mentioning zfp_prec_decompress failures
- Unexpected process termination during data decompression
Network Indicators:
- Unusual compressed data patterns sent to services
- Repeated connection attempts followed by service crashes
SIEM Query:
Process termination events from applications using c-blosc2 combined with incoming network traffic patterns🔗 References
- https://github.com/Blosc/c-blosc2/commit/425e8a9a59d49378d57e2116b6c9b0190a5986f5
- https://github.com/Blosc/c-blosc2/compare/v2.9.2...v2.9.3
- https://github.com/Blosc/c-blosc2/issues/519
- https://github.com/Blosc/c-blosc2/commit/425e8a9a59d49378d57e2116b6c9b0190a5986f5
- https://github.com/Blosc/c-blosc2/compare/v2.9.2...v2.9.3
- https://github.com/Blosc/c-blosc2/issues/519
