Description

An issue was discovered in Cista v0.15 and below. Insecure deserialization of untrusted input under certain conditions may lead to leaking of stack/heap addresses which may be used to bypass ASLR. Classes with pointer-like mechanics under the cista::raw namespace are prone to reference tampering, where Cista does not perform sufficient checks to safeguard against self-referencing pointers and referencing other data within the payload. The leak occurs if the deserialized values are observable by the attacker.

Weaknesses 1

References 2

• cista.com http://cista.com
• gist.github.com https://gist.github.com/TrebledJ/66cc0ed37bdb3e70ce0ef98396790771

Remediation