CVE-2024-3204

What it actually does

Remote heap-based buffer overflow in the ndlz4_decompress function caused by unsanitized input allowing out-of-bounds writes.

Why it matters to the business

Attackers can crash services or potentially run code on systems that compress or decompress data with this library, leading to downtime or data compromise in analytics and storage pipelines.

How an attack unfolds

An attacker sends a specially crafted compressed payload over the network that reaches the vulnerable ndlz4_decompress routine; the malformed data triggers an unbounded write on the heap, enabling control-flow hijacking or denial of service.

How to fix it

Upgrade c-blosc2 to version 2.14.3 or later; apply commit cfaa9c72f25566f630c5f3d32ac9321372c6c93f in source builds and rebuild all dependent packages.

How to confirm the fix worked

Confirm the installed version is at least 2.14.3, run regression tests against the ndlz4 codec with malformed inputs, and verify the fixed commit is present in the build.

Typical attack path

1. Identify a remote service or application that uses c-blosc2 for decompression
2. Craft a malicious ndlz4-compressed blob that exceeds expected buffer sizes
3. Transmit the payload to the target endpoint
4. Trigger the ndlz4_decompress path to induce the heap overflow
5. Leverage the resulting memory corruption for code execution or crash

How to detect it

Review application logs for unexpected crashes or memory errors during decompression of ndlz4 data; inspect process dumps or sanitizer reports for heap overflow indicators around the ndlz4 codec.

What your security team should do

• Immediately upgrade all instances of c-blosc2 to 2.14.3 or newer
• Scan dependency graphs for any packages that embed the vulnerable library
• Add the fixed commit hash to internal SBOM and vulnerability scanners
• Monitor for any new exploit code published after the original disclosure