Executive brief
The bl library is a Node.js utility for handling binary data buffers. A buffer over-read vulnerability allows attackers to read uninitialized memory by corrupting the BufferList state through negative values passed to the consume() function, potentially exposing sensitive data from adjacent memory regions.
Technical details
A buffer over-read vulnerability (CWE-125/CWE-126) exists in bl versions prior to 4.0.3, 3.0.1, 2.2.1, and 1.2.3. The vulnerability occurs when user-supplied input can be passed to the consume() function and becomes negative, corrupting the BufferList internal state. This corruption allows subsequent .slice() calls to read uninitialized memory. The vulnerability requires no authentication or user interaction and is reachable over the network if the bl library is exposed through a network service. An attacker can exploit this to leak sensitive data from the process memory. Patches are available in fixed versions 1.2.3, 2.2.1, 3.0.1, and 4.0.3.
Affected products
- bl bl < 1.2.3, 2.0.0-2.2.0, 3.0.0, 4.0.0-4.0.2
Timeline
- 2020-09-02: disclosed
- 2020-09-02: patched: Patches released in versions 1.2.3, 2.2.1, 3.0.1, and 4.0.3