lz4-sys vulnerable to memory corruption via issue in liblz4

published 2022-08-25 4y ago modified 2026-02-04 9mo ago also RUSTSEC-2022-0051

cvss: 9.8; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

lz4-sys up to v1.9.3 bundles a version of liblz4 that is vulnerable to [CVE-2021-3520](https://nvd.nist.gov/vuln/detail/CVE-2021-3520).

Attackers could craft a payload that triggers an integer overflow upon decompression, causing an out-of-bounds write.

The flaw has been corrected in version v1.9.4 of liblz4, which is included in lz4-sys 1.9.4.

Patch / fix

fixed in 1 links 1

crates.io lz4-sys 1.9.4

github.com/lz4/lz4#972 pull request

Is GHSA-9q5j-jm53-v7vr in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
OSV	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
crates.io	lz4-sys	<1.9.4 >=0.0.0-0, <1.9.4	1.9.4

Classification

Weakness

CWE-190 Integer Overflow or Wraparound
CWE-787 Out-of-bounds Write

References

github.com /lz4/lz4/pull/972
web
rustsec.org /advisories/RUSTSEC-2022-0051.html
web, advisory
crates.io /crates/lz4-sys
package

Sources

GitHub Advisory GHSA-9q5j-jm53-v7vr
OSV RUSTSEC-2022-0051

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.