CVE-2020-8244: Remote Memory Exposure in bl
6.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.58011%
CWE
Published
9/2/2020
Updated
2/1/2023
KEV Status
No
Technology
JavaScript
JavaScriptTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bl | npm | = 3.0.0 | 3.0.1 |
| bl | npm | >= 4.0.0, < 4.0.3 | 4.0.3 |
| bl | npm | < 1.2.3 | 1.2.3 |
| bl | npm | >= 2.0.0, < 2.2.1 | 2.2.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from two key issues: 1) consume() accepting negative values without validation, corrupting the BufferList's state. 2) copy() failing to truncate the destination buffer properly, exposing uninitialized memory. The patches added input validation in consume() (via Math.trunc() and positive checks) and a safeguard in copy() to slice the buffer to the actual copied length. The test cases explicitly target these scenarios by passing negative values to consume() and checking for memory exposure via slice().