vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buff…
High CVSS 7.5
Summary
vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger out-of-memory conditions.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/patriksimek/vm2/security/advisories/GHSA-v836-6xw4-9cx3
- https://www.vulncheck.com/advisories/vm2-before-3.11.6-memory-exhaustion-dos-via-bufferalloclimit-bypass
Timeline
- nvd_ingest NVD