Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded passes to pluginsd_rrddim_put_to_slot in sr…
Medium CVSS 6.5
Summary
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded passes to pluginsd_rrddim_put_to_slot in src/plugins.d/pluginsd_internals.h without an upper bound. prd_array_create in src/database/rrdset-pluginsd-array.h can then wrap the size_t allocation calculation while retaining the original large array size, causing the subsequent initialization loop to write beyond the undersized heap allocation a…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b
- https://github.com/netdata/netdata/pull/22598
- https://github.com/netdata/netdata/releases/tag/v2.10.4
- https://github.com/netdata/netdata/security/advisories/GHSA-3qh4-842w-fvrm
- https://github.com/netdata/netdata/security/advisories/GHSA-3qh4-842w-fvrm
Timeline
- nvd_ingest NVD