Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 464
Alerts This Week
Warning Icon 1 464

Gentoo: GLSA-202406-04 Normal: LZ4 Memory Corruption Risk

gentoo
Calendar Grey June 22, 2024
Scroller Gentoo
Critical LZ4 memory flaw identified in Gentoo advisory GLSA 202406-04. Urgent patch advised for impacted users.
A vulnerability has been discovered in LZ4, which can lead to memory corruption.

Summary

An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash.

Topics%20covered

Topics Covered

security advisory gentoo memory corruption integer overflow normal severity crash risk lz4

Resolution

All LZ4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/lz4-1.9.3-r1"

References

[ 1 ] CVE-2021-3520 https://nvd.nist.gov/vuln/detail/CVE-2021-3520

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202406-04
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: LZ4: Memory Corruption
Date: June 22, 2024
Bugs: #791952
ID: 202406-04

Topics%20covered

Topics Covered

security advisory gentoo memory corruption integer overflow normal severity crash risk lz4

Synopsis

A vulnerability has been discovered in LZ4, which can lead to memory corruption.

Background

LZ4 is a lossless compression algorithm, providing compression speed > 500 MB/s per core, scalable with multi-cores CPU. It features an extremely fast decoder, with speed in multiple GB/s per core, typically reaching RAM speed limits on multi-core systems.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

Package Vulnerable Unaffected ------------ ------------ ------------ app-arch/lz4 < 1.9.3-r1 >= 1.9.3-r1

Impact

The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

Workaround

There is no known workaround at this time.