Executive brief
The 'posix' library, which provides essential system-level functions for Node.js applications, contains a flaw that can cause an application to crash unexpectedly. By providing specially crafted input to certain functions within this library, an attacker can trigger a fatal error that shuts down the service. This results in a denial of service, potentially impacting business operations and service availability for legitimate users.
Technical details
The 'posix' package for Node.js fails to properly validate input types when certain system call wrappers are invoked. Specifically, if an object is passed where the 'toString' property is defined but is not a function (e.g., an integer), the underlying C++ bindings attempt to invoke it, fail, and fallback to a null pointer (0x0). This results in a type-check failure and a subsequent process crash. An attacker can exploit this by passing crafted objects to functions like 'setegid', leading to a Denial of Service (DoS). As of the latest advisory, there is no official patch available for this vulnerability.
Affected products
- ohmu posix All versions up to and including 4.2.0
Timeline
- 2022-02-14: disclosed: Vulnerability disclosed by Snyk Research Team
- 2022-06-10: advisory: NVD published CVE-2022-21211
- 2022-06-11: advisory: GitHub Advisory published