CVE-2022-46149

Publication date 30 November 2022

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

5.4 · Medium

Score breakdown

Cap’n Proto is a data interchange format and remote procedure call (RPC) system. Cap’n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap’n Proto’s Rust implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to out-of-bounds read due to logic error handling list-of-list. This issue may lead someone to remotely segfault a peer by sending it a malicious message, if the victim performs certain actions on a list-of-pointer type. Exfiltration of memory is possible if the victim performs additional certain actions on a list-of-pointer type. To be vulnerable, an application must perform a specific sequence of actions, described in the GitHub Security Advisory. The bug is present in inlined code, therefore the fix will require rebuilding dependent applications. Cap’n Proto has C++ fixes available in versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3. The `capnp` Rust crate has fixes available in versions 0.13.7, 0.14.11, and 0.15.2.

Read the notes from the security team

Status

Package Ubuntu Release Status
capnproto 25.04 plucky
Not affected
24.10 oracular
Not affected
24.04 LTS noble
Not affected
23.10 mantic
Not affected
23.04 lunar
Not affected
22.10 kinetic Ignored
22.04 LTS jammy Ignored
20.04 LTS focal Ignored
18.04 LTS bionic Ignored
16.04 LTS xenial
Vulnerable
14.04 LTS trusty Ignored
interchange 22.10 kinetic Not in release
22.04 LTS jammy Not in release
20.04 LTS focal Not in release
18.04 LTS bionic Not in release
16.04 LTS xenial
Vulnerable
14.04 LTS trusty Ignored end of standard support

Notes

mdeslaur

Per upstream: “Unfortunately, the bug is present in inlined code, therefore the fix will require rebuilding dependent applications.” “To be vulnerable, an application must perform a specific sequence of actions, described below. At present, we are not aware of any vulnerable application, but we advise updating regardless.” capnproto is in main in bionic and focal only, and the only reverse depends in main is mir The upstream fix introduces changes both to inline code and to the library which means fixing this will break ABI. Due to the likelyhood of breaking applications, and the fact that it is unlikely applications do the specific sequence of actions to trigger this vulnerability, we will not be fixing this issue in Ubuntu.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
capnproto

Severity score breakdown

Parameter Value
Base score 5.4 · Medium
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Scope Unchanged
Confidentiality Low
Integrity impact None
Availability impact Low
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L