DocumentationSeverity
Details
- CVSS score
- 5.9
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- CWE ID
Overview
About vulnerability
Summary
MariaDB Connector/J narrowed 8-byte length-encoded integers received from the
server to int without validation. A rogue or MitM server can send a value above
Integer.MAX_VALUE whose truncation becomes a negative or arbitrary length.
Details
The protocol encodes lengths as length-encoded integers, whose 8-byte form the
decoder (readLength() and readIntLengthEncodedNotNull()) returned as
(int) readLong(). A value above Integer.MAX_VALUE therefore wrapped to a
negative or unrelated int, used afterwards as a length to size allocations or
reads, which ended in NegativeArraySizeException, out-of-bounds exceptions or
oversized allocations.
The fix rejects any length-encoded value that does not fit a non-negative int
with an explicit error.
Impact
Availability only: a malicious or compromised server, or a MitM, can crash the client’s connection handling with unchecked exceptions or drive oversized allocations. Exploitation requires control of the server side of the connection; no authentication bypass, confidentiality or integrity impact.
Credit
Reported by fg0x0