CVE-2019-12408

Uninitialized memory bug in Apache Arrow 0.14.0 to 0.14.1 C++ implementation

• CVSS 7.5
• CWE-909 Missing Initialization of Resource
• Input Validation and Sanitization
• Remote

It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.

CVE

CVE-2019-12408

CWE

CWE-909 Missing Initialization of Resource

CVSS base score

7.5

Published

2019-11-08

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update Apache Arrow to version 0.15.0 or higher.

import pyarrow as pa

def create_array_with_nulls(data):
    array = pa.array(data, mask=[value is None for value in data])
    return array

data = [1, None, 3, None, 5]
array_with_nulls = create_array_with_nulls(data)
print(array_with_nulls)

import pyarrow as pa

def create_array_with_nulls(data):
    initialized_data = [value if value is not None else 0 for value in data]
    array = pa.array(initialized_data, mask=[value is None for value in data])
    return array

data = [1, None, 3, None, 5]
array_with_nulls = create_array_with_nulls(data)
print(array_with_nulls)

@misc{vaitp:cve201912408,
  title        = {{Uninitialized memory bug in Apache Arrow 0.14.0 to 0.14.1 C++ implementation}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2019-12408},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-12408/}}
}