Abseil-cpp Heap Buffer Overflow Vulnerability in Hash Containers

A heap buffer overflow vulnerability has been identified in Abseil-cpp, specifically within the sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map}. These methods did not enforce a maximum limit on the size parameter, allowing callers to input excessively large sizes. This oversight could lead to an integer overflow when calculating the size of the container's backing store, followed by an out-of-bounds memory write. Additionally, subsequent accesses to the container could reach out-of-bounds memory, potentially causing further issues.

Impact

Exploitation of this vulnerability can lead to a heap buffer overflow, allowing for out-of-bounds memory writes and accesses.

Reproduction

The vulnerability can be reproduced by using the sized constructors, reserve(), or rehash() methods of absl::{flat,node}hash{set,map} without specifying a size limit. Passing a size that exceeds the container's capacity can trigger the integer overflow and subsequent heap buffer overflow.

Remediation

Users are advised to upgrade to version 0~20200923.3-2+deb11u1 or later.