CVE-2022-37454Critical· 9.8▾ MidnightBuffer overflow in sponge queue functions
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 1.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
5.2%
5.2% → 5.7%
Last analysed / modified upstream
The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more.
Yes, see commit fdc6fef0.
The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether.
See issue #105 for more details.
pysha3 <= 1.0.2sha3 < 1.0.5Upgrade to a patched release:
sha3 1.0.5