CVE-2024-3203
📋 TL;DR
A critical heap-based buffer overflow vulnerability exists in c-blosc2's ndlz8_decompress function, allowing remote attackers to execute arbitrary code or crash affected systems. This affects all users of c-blosc2 up to version 2.13.2 who process untrusted compressed data. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- c-blosc2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment
Likely Case
Denial of service through application crashes, with potential for remote code execution in targeted attacks
If Mitigated
Application crashes without code execution if exploit attempts are blocked or memory protections are enabled
🎯 Exploit Status
Exploit details have been publicly disclosed, making weaponization likely
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.14.3
Vendor Advisory: https://github.com/Blosc/c-blosc2/releases/tag/v2.14.3
Restart Required: Yes
Instructions:
1. Download c-blosc2 v2.14.3 from GitHub releases 2. Replace existing installation with patched version 3. Recompile any applications using c-blosc2 4. Restart affected services
🔧 Temporary Workarounds
Disable ndlz codec
allDisable the vulnerable ndlz codec if not required
Recompile c-blosc2 with -DBLOSC_DISABLE_NDLZ=ON
🧯 If You Can't Patch
- Implement strict input validation and sanitization for compressed data
- Deploy network segmentation and restrict access to vulnerable systems
🔍 How to Verify
Check if Vulnerable:
Check c-blosc2 version: if version ≤ 2.13.2, system is vulnerableCheck Version:
Check library version in application or run: strings /path/to/libblosc2.so | grep 'c-blosc2'Verify Fix Applied:
Verify c-blosc2 version is ≥ 2.14.3 and test decompression with known malicious payloads📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Memory corruption errors in system logs
Network Indicators:
- Unusual network traffic to systems using c-blosc2
- Exploit kit traffic patterns
SIEM Query:
source="application_logs" AND ("segmentation fault" OR "heap corruption") AND process="*blosc*"🔗 References
- https://drive.google.com/drive/folders/1T1k3UeS09m65LjVXExUuZfedNQPWQWCo?usp=sharing
- https://github.com/Blosc/c-blosc2/releases/tag/v2.14.3
- https://vuldb.com/?ctiid.259050
- https://vuldb.com/?id.259050
- https://vuldb.com/?submit.304556
- https://drive.google.com/drive/folders/1T1k3UeS09m65LjVXExUuZfedNQPWQWCo?usp=sharing
- https://github.com/Blosc/c-blosc2/releases/tag/v2.14.3
- https://vuldb.com/?ctiid.259050
- https://vuldb.com/?id.259050
- https://vuldb.com/?submit.304556
