A vulnerability has been discovered in LZ4, which can lead to memory corruption.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/lz4 | * | < 1.9.3-r1 | >= 1.9.3-r1 |
LZ4 is a lossless compression algorithm, providing compression speed > 500 MB/s per core, scalable with multi-cores CPU. It features an extremely fast decoder, with speed in multiple GB/s per core, typically reaching RAM speed limits on multi-core systems.
An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash.
The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
There is no known workaround at this time.
All LZ4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/lz4-1.9.3-r1"