Vulnerability · Published Jan 26, 2022 · Assigned by Google
CVE-2021-22570Nullptr Dereference in Protobuf
Medium 6.5
In plain English
A medium-severity null pointer dereference in Protobuf from Google LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | protobuf | 3.5.0-15.el8 | ALSA-2022:7464 |
| AlmaLinux:9 | protobuf | 3.14.0-13.el9 | ALSA-2022:7970 |
| AlmaLinux:8 | protobuf-compiler | 3.5.0-15.el8 | ALSA-2022:7464 |
| AlmaLinux:9 | protobuf-compiler | 3.14.0-13.el9 | ALSA-2022:7970 |
| AlmaLinux:8 | protobuf-devel | 3.5.0-15.el8 | ALSA-2022:7464 |
| AlmaLinux:9 | protobuf-devel | 3.14.0-13.el9 | ALSA-2022:7970 |
| AlmaLinux:8 | protobuf-lite | 3.5.0-15.el8 | ALSA-2022:7464 |
| AlmaLinux:9 | protobuf-lite | 3.14.0-13.el9 | ALSA-2022:7970 |
| AlmaLinux:8 | protobuf-lite-devel | 3.5.0-15.el8 | ALSA-2022:7464 |
| AlmaLinux:9 | protobuf-lite-devel | 3.14.0-13.el9 | ALSA-2022:7970 |
| AlmaLinux:8 | python3-protobuf | 3.5.0-15.el8 | ALSA-2022:7464 |
| AlmaLinux:9 | python3-protobuf | 3.14.0-13.el9 | ALSA-2022:7970 |
| Debian:12 | protobuf | 3.21.9-3 | DEBIAN-CVE-2021-22570 |
| Debian:13 | protobuf | 3.21.9-3 | DEBIAN-CVE-2021-22570 |
| Debian:14 | protobuf | 3.21.9-3 | DEBIAN-CVE-2021-22570 |
| Go | github.com/protocolbuffers/protobuf | 0.0.0-20210218195015-ae50d9b99025 | GHSA-77rm-9x9h-xj3g |
| Go | github.com/protocolbuffers/protobuf | 3.15.0 | GHSA-77rm-9x9h-xj3g |
| Maven | com.google.protobuf:protobuf-java | 3.15.0 | GHSA-77rm-9x9h-xj3g |
| NuGet | google.protobuf | 3.15.0 | GHSA-77rm-9x9h-xj3g |
| Packagist | google/protobuf | 3.15.0 | GHSA-77rm-9x9h-xj3g |
| PyPI | protobuf | 3.15.0 | GHSA-77rm-9x9h-xj3g |
| PyPI | protobuf | 3.15.0 | PYSEC-2022-48 |
| Rocky Linux:8 | protobuf | 0:3.5.0-15.el8 | RLSA-2022:7464 |
| Rocky Linux:9 | protobuf | 0:3.14.0-13.el9 | RLSA-2022:7970 |
| Ubuntu:22.04:LTS | protobuf | 3.12.4-1ubuntu7.22.04.1 | USN-5945-1 |
| Ubuntu:22.04:LTS | protobuf | 3.12.4-1ubuntu7.22.04.1 | UBUNTU-CVE-2021-22570 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google LLC | Protobuf | unspecified – before 3.15.0 |
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/protocolbuffers/protobuf/releases/tag/v3.15.0
- FEDORA-2022-ffe4a1cedd vendor-advisory
- FEDORA-2022-2d3e6eb9e4 vendor-advisory
- FEDORA-2022-fedff53e4e vendor-advisory
- FEDORA-2022-486d5f349d vendor-advisory
- FEDORA-2022-d1a15f9cdb vendor-advisory
- FEDORA-2022-49b52819a4 vendor-advisory
- FEDORA-2022-57923346cf vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220429-0005/
- [debian-lts-announce] 20230418 [SECURITY] [DLA 3393-1] protobuf security update mailing-list