Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-36124

CVE-2022-36124: Apache Avro Rust SDK's Reader could consume memory beyond allowed constraints

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-36124
GHSA ID
GHSA-wcm8-86x6-8mv3
EPSS Score
0.85964%
CWE
CWE-770
Published
8/10/2022
Updated
1/28/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
apache-avrorust< 0.14.00.14.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from uncontrolled memory allocation during Avro data block processing. Avro's block-based format includes a header with record count and size. The Reader's read_block function would be responsible for parsing this header and allocating memory for records. Without validation of these values (e.g., maximum allowed records/size), a malicious block with a large count would force the SDK to allocate proportional memory, matching CWE-770's pattern. The high confidence comes from: 1) The vulnerability's direct association with Reader memory consumption 2) The critical role of block reading in Avro's architecture 3) The CWE-770 alignment with unvalidated block size/count parsing.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

It is possi*l* *or * R****r to *onsum* m*mory **yon* t** *llow** *onstr*ints *n* t*us l*** to out o* m*mory on t** syst*m. T*is issu* *****ts Rust *ppli**tions usin* *p**** *vro Rust S*K prior to *.**.* (pr*viously known *s *vro-rs). Us*rs s*oul* up*

Reasoning

T** vuln*r**ility st*ms *rom un*ontroll** m*mory *llo**tion *urin* *vro **t* *lo*k pro**ssin*. *vro's *lo*k-**s** *orm*t in*lu**s * *****r wit* r**or* *ount *n* siz*. T** R****r's r***_*lo*k *un*tion woul* ** r*sponsi*l* *or p*rsin* t*is *****r *n* *