CVE-2024-3204: Blosc C-blosc2 Buffer Overflow Vulnerability

CVE-2024-3204 Overview

A critical heap-based buffer overflow vulnerability has been identified in c-blosc2, a high-performance data compression library. This vulnerability affects the ndlz4_decompress function located in /src/c-blosc2/plugins/codecs/ndlz/ndlz4x4.c. The flaw allows remote attackers to manipulate compressed data in a way that triggers a heap-based buffer overflow during decompression operations, potentially leading to arbitrary code execution or system compromise.

Critical Impact

This vulnerability can be exploited remotely without authentication to achieve code execution by triggering a heap-based buffer overflow during data decompression operations.

Affected Products

• blosc c-blosc2 versions up to 2.13.2

Discovery Timeline

• 2024-04-02 - CVE-2024-3204 published to NVD
• 2025-04-25 - Last updated in NVD database

Technical Details for CVE-2024-3204

Vulnerability Analysis

This vulnerability is classified as CWE-122 (Heap-based Buffer Overflow), a memory corruption flaw that occurs when data written to a heap-allocated buffer exceeds the buffer's allocated size. The vulnerable function ndlz4_decompress in the NDLZ4 codec plugin fails to properly validate the size of incoming compressed data before writing to the destination buffer during decompression.

The c-blosc2 library is widely used for high-performance compression in scientific computing, data analytics, and storage applications. When processing maliciously crafted compressed data, the decompression routine can be tricked into writing beyond the allocated heap buffer boundaries. This can corrupt adjacent heap metadata or other application data structures, potentially allowing an attacker to achieve arbitrary code execution.

The network-accessible attack vector makes this particularly dangerous for applications that accept and decompress user-supplied data from untrusted sources. No user interaction or authentication is required to exploit this vulnerability.

Root Cause

The root cause lies in insufficient bounds checking within the ndlz4_decompress function. When processing NDLZ4-compressed blocks, the function does not adequately validate that the decompressed output will fit within the allocated destination buffer. An attacker can craft a malicious compressed payload that specifies output sizes larger than the actual buffer allocation, causing the decompression routine to write past the buffer boundaries on the heap.

Attack Vector

The attack can be launched remotely by sending specially crafted compressed data to an application using vulnerable versions of c-blosc2. The attacker constructs a malicious NDLZ4-compressed payload where the encoded length fields indicate a larger decompressed size than the target buffer can accommodate.

When the application attempts to decompress this malicious data using the vulnerable ndlz4_decompress function, the heap buffer overflow occurs. Depending on the application's memory layout and the attacker's ability to control heap state, this can be leveraged for arbitrary code execution, denial of service, or information disclosure.

The vulnerability has been disclosed to the public and proof-of-concept materials have been shared. Technical details can be found in the VulDB entry for CVE-2024-3204 and supporting documentation in the shared research folder.

Detection Methods for CVE-2024-3204

Indicators of Compromise

• Unexpected application crashes or segmentation faults during decompression operations
• Anomalous memory access patterns in applications using c-blosc2 for data processing
• Core dumps indicating heap corruption in the vicinity of NDLZ codec operations
• Unusually large or malformed compressed data payloads received from external sources

Detection Strategies

• Deploy memory corruption detection tools such as AddressSanitizer (ASan) in development and testing environments to identify heap overflow conditions
• Implement input validation to reject compressed data from untrusted sources exceeding reasonable size thresholds
• Monitor application logs for crashes originating from c-blosc2 decompression routines
• Use Software Composition Analysis (SCA) tools to identify applications and containers running vulnerable c-blosc2 versions

Monitoring Recommendations

• Enable heap corruption detection mechanisms in production monitoring where performance permits
• Track version information of c-blosc2 libraries across the software inventory
• Monitor network traffic for anomalously large or frequent compressed data transfers to applications using this library
• Implement application-level logging around decompression operations to aid forensic analysis

How to Mitigate CVE-2024-3204

Immediate Actions Required

• Upgrade c-blosc2 to version 2.14.3 or later, which contains the security fix for this vulnerability
• Audit applications and dependencies to identify all instances of c-blosc2 usage
• If immediate patching is not possible, restrict network access to applications that process compressed data using vulnerable versions
• Review and validate the source of any compressed data processed by affected applications

Patch Information

The vulnerability has been addressed in c-blosc2 version 2.14.3. The fix implements proper bounds checking in the ndlz4_decompress function to prevent heap buffer overflow conditions. Organizations should upgrade to this version or later to remediate the vulnerability.

The patched release is available from the GitHub c-blosc2 Release v2.14.3.

Workarounds

• Implement strict input validation and size limits on compressed data before passing to c-blosc2 decompression functions
• Sandbox or isolate applications that must process untrusted compressed data using vulnerable library versions
• Deploy Web Application Firewalls (WAF) or network-based controls to filter potentially malicious compressed payloads
• Consider using alternative compression codecs within c-blosc2 that are not affected until the upgrade can be completed

# Upgrade c-blosc2 to patched version
# For source installations:
git clone https://github.com/Blosc/c-blosc2.git
cd c-blosc2
git checkout v2.14.3
mkdir build && cd build
cmake ..
make && sudo make install

# For conda installations:
conda update c-blosc2

# Verify installed version
blosc2_info --version