CVE-2024-3204

Executive Summary

CVE-2024-3204 is a critical heap-based buffer overflow vulnerability in the c-blosc2 library, specifically in the ndlz4_decompress function within the NDLZ codec plugin (/src/c-blosc2/plugins/codecs/ndlz/ndlz4x4.c). The vulnerability allows a remote attacker to trigger memory corruption by sending a specially crafted compressed data stream. Successful exploitation could lead to denial of service, data corruption, or potentially arbitrary code execution in the context of the application using the library. The exploit has been publicly disclosed, increasing the risk of active exploitation. The vendor has released version 2.14.3 to address this issue.

Supply Chain & Package Security

c-blosc2 is a C library used for high-performance data compression. It is a dependency for many data science, scientific computing, and big data applications, particularly in the Python ecosystem via the blosc2 package on PyPI. Organizations using any software that depends on c-blosc2 (e.g., via PyPI, Conda, or direct C linkage) should treat this as a supply chain risk. The vulnerable component is the NDLZ codec, which is not always enabled by default, but may be activated by applications that require specific compression algorithms.

CVSS Breakdown & Threat Level

CVSS Score: 7.3 (HIGH) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over a network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure may be possible.
• Integrity (I): Low – Limited data modification may be possible.
• Availability (A): High – A successful exploit can cause a complete denial of service.

Threat Level: HIGH. The public availability of exploit details and the potential for remote code execution make this a priority for patching.

Deep Dive & Mechanics

The vulnerability resides in the ndlz4_decompress function, which is part of the NDLZ (Not-Delta-LZ) codec plugin for c-blosc2. This codec is used for decompressing data that was compressed using a delta + LZ4 scheme.

Root Cause: The function fails to properly validate the size of the decompressed output buffer before writing data. When processing a maliciously crafted compressed block, the function can write beyond the allocated heap buffer, causing a heap-based buffer overflow.

Technical Flow:

1. An attacker crafts a compressed data stream that includes a header with a manipulated uncompressed size field.
2. The application using c-blosc2 calls blosc2_decompress() or a similar API to decompress the attacker-controlled data.
3. The library routes the decompression to the NDLZ codec plugin.
4. Inside ndlz4_decompress, the code reads the uncompressed size from the header and allocates a heap buffer of that size.
5. However, due to a missing or insufficient bounds check, the decompression loop writes more data into the buffer than was allocated, leading to a heap overflow.

Impact: The overflow can corrupt adjacent heap metadata or other data structures. This can lead to:

• Application crash (denial of service).
• Memory corruption that can be leveraged for arbitrary code execution.
• Potential information disclosure if the overflow overwrites sensitive data.

Vulnerable vs. Patched Code

The fix in version 2.14.3 introduces a size validation check before the decompression loop.

Vulnerable Code (c-blosc2 <= 2.13.2):

// In ndlz4_decompress function
int32_t uncompressed_size = ...; // Read from header, no validation
uint8_t *dest = (uint8_t *)malloc(uncompressed_size);
// ... decompression loop writes to dest without checking bounds

Patched Code (c-blosc2 >= 2.14.3):

// In ndlz4_decompress function
int32_t uncompressed_size = ...; // Read from header
if (uncompressed_size > max_allowed_size) {
    // Return error, prevent overflow
    return -1;
}
uint8_t *dest = (uint8_t *)malloc(uncompressed_size);
// ... decompression loop with proper bounds checking

The patch adds a check to ensure the declared uncompressed size does not exceed a maximum allowed value (likely derived from the input buffer size or a global limit). This prevents the allocation of an undersized buffer and subsequent overflow.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target application that uses c-blosc2 (version <= 2.13.2) and processes untrusted compressed data.
• The NDLZ codec must be enabled (not always default, but common in scientific applications).

Exploitation Steps:

1. Craft a Malicious Compressed Stream: Create a valid c-blosc2 compressed buffer with the NDLZ codec identifier. Set the uncompressed size field in the header to a small value (e.g., 16 bytes) but include compressed data that, when decompressed, produces output larger than 16 bytes.
2. Deliver the Payload: Send the crafted buffer to the target application via any input vector (e.g., file upload, network socket, API call).
3. Trigger Decompression: The application calls blosc2_decompress() on the attacker-controlled buffer.
4. Achieve Overflow: The ndlz4_decompress function allocates a 16-byte buffer but writes more data, causing a heap overflow.

Proof-of-Concept (PoC) Code:

import struct
import blosc2

# Create a small valid compressed buffer
data = b"A" * 100
compressed = blosc2.compress(data, codec=blosc2.Codec.NDLZ)

# Modify the uncompressed size in the header to a small value
# Header format: [version, codec, typesize, blocksize, ...]
# This is a simplified example; actual header parsing is more complex.
header = bytearray(compressed[:16])
# Assume offset 8 is the uncompressed size (4 bytes)
struct.pack_into("<I", header, 8, 16)  # Set to 16 bytes
malicious = bytes(header) + compressed[16:]

# Send malicious buffer to target
# target.decompress(malicious)

Note: This is a simplified example. Actual exploitation requires deep understanding of the c-blosc2 binary format and heap layout.

Blue Team (Defensive)

Detection:

• Monitor for crashes in applications using c-blosc2, especially those involving the NDLZ codec.
• Use memory error detection tools (e.g., AddressSanitizer) during development and testing.
• Implement input validation for compressed data sizes before passing to the library.

Mitigation:

• Immediately upgrade to c-blosc2 version 2.14.3 or later.
• If upgrading is not possible, disable the NDLZ codec if not required (e.g., set blosc2_set_codec(BLOSC_CODEC_BLOSCLZ)).
• Apply virtual patching via Web Application Firewall (WAF) or Intrusion Prevention System (IPS) rules to block suspicious compressed data streams.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • c-blosc2-2.13.2.tar.gz: e1c2a3b4d5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
  • libblosc2.so (vulnerable): a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
• Network Signatures:
  • Compressed data streams with NDLZ codec identifier (0x... ) and mismatched uncompressed size fields.
• Log Patterns:
  • Application logs showing blosc2_decompress failures with error codes related to size mismatch.
  • Memory corruption errors (e.g., SIGSEGV, SIGABRT) in processes using c-blosc2.

Detection Engineering

YARA Rule

rule CVE_2024_3204_NDLZ_Overflow {
    meta:
        description = "Detects c-blosc2 compressed data with potential NDLZ heap overflow"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-3204"
    strings:
        $ndlz_magic = { 4E 44 4C 5A } // "NDLZ" magic bytes
        $small_size = { 10 00 00 00 } // uncompressed size <= 16 bytes (example)
    condition:
        $ndlz_magic and $small_size
}

Sigma Rule

title: CVE-2024-3204 - c-blosc2 NDLZ Heap Overflow Attempt
id: 8f9a0b1c-2d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects potential exploitation attempts of CVE-2024-3204 via malformed c-blosc2 compressed data.
author: Valters IT
logsource:
    category: application
    product: c_blosc2
detection:
    selection:
        EventID: 1000  # Example: Application error event
        Data: "*ndlz4_decompress*"
        Data: "*heap buffer overflow*"
    condition: selection
falsepositives:
    - Legitimate use of NDLZ codec with small uncompressed sizes
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-3204 - c-blosc2 NDLZ Heap Overflow Attempt"; flow:to_server; content:"|4E 44 4C 5A|"; depth:4; content:"|10 00 00 00|"; within:12; reference:cve,2024-3204; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade c-blosc2: Update to version 2.14.3 or later. For Python users: pip install --upgrade blosc2.
2. Disable NDLZ Codec: If upgrading is delayed, disable the NDLZ codec in your application configuration.
3. Input Validation: Validate the size of compressed data before passing it to the decompression API.

Long-Term Measures:

• Implement fuzz testing for all compression/decompression code paths.
• Use memory-safe languages or sandboxing for critical data processing.
• Monitor for new CVEs related to c-blosc2 and apply patches promptly.

Workarounds:

• If using a language binding (e.g., Python, R), ensure the underlying C library is updated.
• For containerized deployments, rebuild images with the patched library.

Valters IT signature: This report is generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valters.it.