Miggo Logo

CVE-2023-28445: Deno improperly handles resizable ArrayBuffer

10

CVSS Score
3.1

Basic Information

EPSS Score
0.51421%
Published
3/23/2023
Updated
5/4/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
Denorust= 1.32.01.32.1
serde_v8rust= 0.87.00.88.0
deno_runtimerust= 0.102.00.103.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper handling of resizable ArrayBuffers in async contexts. The core issue was in serde_v8's V8Slice implementation, which provided direct buffer access without revalidating the BackingStore's length after potential resizing. The patches in denoland/deno#18452 explicitly modified these methods to check the current buffer length and truncate slices when necessary. This indicates the original implementations of V8Slice::open and V8Slice::open_mut were vulnerable to OOB access when buffers were resized during async operations, as they relied on initial length values rather than current state.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t [R*siz**l* *rr*y*u***rs](*ttps://*it*u*.*om/t***/propos*l-r*siz**l**rr*y*u***r) p*ss** to *syn**ronous n*tiv* *un*tions t**t *r* s*runk *urin* t** *syn**ronous op*r*tion *oul* r*sult in *n out-o*-*oun* r***/writ*. It is unlik*ly t**t t*i

Reasoning

T** vuln*r**ility st*ms *rom improp*r **n*lin* o* r*siz**l* *rr*y*u***rs in *syn* *ont*xts. T** *or* issu* w*s in s*r**_v*'s V*Sli** impl*m*nt*tion, w*i** provi*** *ir**t *u***r ****ss wit*out r*v*li**tin* t** ***kin*Stor*'s l*n*t* **t*r pot*nti*l r*