CVE-2023-37187
📋 TL;DR
CVE-2023-37187 is a NULL pointer dereference vulnerability in c-blosc2's zfp compression module that can cause denial of service (crash) when processing malicious data. This affects applications using c-blosc2 for data compression/decompression, particularly those handling untrusted input. The vulnerability is in the zfp_acc_decompress function and requires the zfp plugin to be enabled.
💻 Affected Systems
- c-blosc2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Application crash leading to denial of service, potentially disrupting data processing pipelines or services relying on c-blosc2 for compression operations.
Likely Case
Application instability or crash when processing specially crafted compressed data, resulting in service interruption.
If Mitigated
Minimal impact if proper input validation and error handling are implemented at the application layer.
🎯 Exploit Status
Exploitation requires crafting malicious compressed data that triggers the NULL pointer dereference. No authentication is needed if the vulnerable function processes external input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.3
Vendor Advisory: https://github.com/Blosc/c-blosc2/commit/425e8a9a59d49378d57e2116b6c9b0190a5986f5
Restart Required: Yes
Instructions:
1. Update c-blosc2 to version 2.9.3 or later. 2. Recompile any applications using c-blosc2. 3. Restart affected services. 4. For package managers: Use appropriate update command (apt-get upgrade, yum update, etc.) for your distribution.
🔧 Temporary Workarounds
Disable zfp plugin
allDisable the zfp compression plugin if not required, as the vulnerability is specific to this component.
Recompile c-blosc2 with -DBLOSC2_ZFP_SUPPORT=OFF or modify build configuration to exclude zfp support.
🧯 If You Can't Patch
- Implement input validation and sanitization for compressed data before passing to c-blosc2 functions.
- Use application-level error handling to catch and manage crashes from c-blosc2 operations.
🔍 How to Verify
Check if Vulnerable:
Check c-blosc2 version and if zfp plugin is enabled. For compiled applications, check linked library versions.Check Version:
For library: blosc2_get_version() function. For packages: dpkg -l libblosc2* or rpm -qa | grep blosc2Verify Fix Applied:
Verify c-blosc2 version is 2.9.3 or later and recompile applications with the updated library.📡 Detection & Monitoring
Log Indicators:
- Application crashes or segmentation faults when processing compressed data
- Error messages related to NULL pointer dereference in c-blosc2/zfp functions
Network Indicators:
- Unusual patterns of compressed data being sent to services using c-blosc2
SIEM Query:
Process crashes with module containing 'blosc2' or 'zfp' in stack trace🔗 References
- https://github.com/Blosc/c-blosc2/commit/425e8a9a59d49378d57e2116b6c9b0190a5986f5
- https://github.com/Blosc/c-blosc2/compare/v2.9.2...v2.9.3
- https://github.com/Blosc/c-blosc2/issues/520
- https://github.com/Blosc/c-blosc2/commit/425e8a9a59d49378d57e2116b6c9b0190a5986f5
- https://github.com/Blosc/c-blosc2/compare/v2.9.2...v2.9.3
- https://github.com/Blosc/c-blosc2/issues/520
