Security
Security
A vulnerability has been discovered in LZ4, which can lead to memory corruption.
| Package | app-arch/lz4 on all architectures |
|---|---|
| Affected versions | < 1.9.3-r1 |
| Unaffected versions | >= 1.9.3-r1 |
LZ4 is a lossless compression algorithm, providing compression speed > 500 MB/s per core, scalable with multi-cores CPU. It features an extremely fast decoder, with speed in multiple GB/s per core, typically reaching RAM speed limits on multi-core systems.
An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash.
The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
There is no known workaround at this time.
All LZ4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/lz4-1.9.3-r1"
Release date
June 22, 2024
Latest revision
June 22, 2024: 1
Severity
normal
Exploitable
local
Bugzilla entries