Coordinated Disclosure Timeline
- 2022-08-24: Reported to Anton Adamansky, the lead maintainer
-
2022-08-25: Issue has been addressed with commit
- 2022-08-27: Maintainer has delayed response to requests for security advisory.
- 2022-09-06: Assigned CVE-2022-23462
Summary
There is a stack buffer overflow present in iowow that allows for Denial of Service (DOS) when it parses scientific notation numbers present in JSON.
Product
iowow
Tested Version
Latest
Details
Issue: stack buffer overflow in iwjson.c (GHSL-2022-066)
void iwjson_ftoa(long double val, char buf[static IWNUMBUF_SIZE], size_t *out_len) {
int len = snprintf(buf, 64, "%.8Lf", val);
buf has size IWNUMBUF_SIZE (32) but the format string assumes a size of 64 resulting in a stack buffer overflow. This allows for DOS due to a stack canary overwrite. Without a stack canary, instruction pointer can be overwritten with numerical values 0x30 to 0x39.
Impact
This issue may lead to Denial of Service (DOS).
CVE
- CVE-2022-23462
Credit
This issue was discovered and reported by GHSL team member @Kwstubbs (Kevin Stubbings).
Contact
You can contact the GHSL team at securitylab@github.com, please include a reference to GHSL-2022-066 in any communication regarding this issue.