Skip to content
OpenAdvisories
Medium · 5.4 CVE-2022-46149 EUVD-2022-7720GHSA-qqff-4vw4-f6hxRUSTSEC-2022-0068

Cap'n Proto vulnerable to out-of-bounds read due to logic error handling list-of-list.

Published Nov 30, 2022 · Updated Apr 23, 2025 · Assigned by GitHub_M

Description

Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to out-of-bounds read due to logic error handling list-of-list. This issue may lead someone to remotely segfault a peer by sending it a malicious message, if the victim performs certain actions on a list-of-pointer type. Exfiltration of memory is possible if the victim performs additional certain actions on a list-of-pointer type. To be vulnerable, an application must perform a specific sequence of actions, described in the GitHub Security Advisory. The bug is present in inlined code, therefore the fix will require rebuilding dependent applications. Cap'n Proto has C++ fixes available in versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3. The `capnp` Rust crate has fixes available in versions 0.13.7, 0.14.11, and 0.15.2.

Affected products

VendorProductAffectedFixed
capnproto capnproto < 0.7.1, >= 0.8.0, < 0.8.1, >= 0.9.0, < 0.9.2, >= 0.10.0, < 0.10.3, >= 0.13.0, < 0.13.7, >= 0.14.0, < 0.14.11, >= 0.15.0, < 0.15.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 capnproto 0.9.2-2 —
Debian 14 rust-capnp 0.14.11-1.1 —
Debian 13 capnproto 0.9.2-2 —
Debian 13 rust-capnp 0.14.11-1.1 —
Debian 12 capnproto 0.9.2-2 —
Debian 12 rust-capnp 0.14.11-1.1 —
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS capnproto No fix yet —
Ubuntu 16.04 LTS capnproto +1 No fix yet —
Ubuntu 14.04 LTS capnproto No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS capnproto No fix yet —
Ubuntu Pro 18.04 LTS capnproto No fix yet —
ReleasePackageFixed inAdvisory
Red Hat OpenShift 4 conmon-rs 0.5.1-3.rhaos4.12.git.el8 RHSA-2023:1408
ReleasePackageFixed inAdvisory
SLES 15 SP4 capnproto 0.9.1-150400.3.4.1 SUSE-SU-2022:4478-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-pycapnp 2.0.0-2.5 openSUSE-SU-2025:15102-1
openSUSE Leap 15.4 capnproto 0.9.1-150400.3.4.1 SUSE-SU-2022:4478-1

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io capnp >= 0.15.0, < 0.15.2 0.15.2 GHSA-qqff-4vw4-f6hx
crates.io capnp >= 0.14.0, < 0.14.11 0.14.11 GHSA-qqff-4vw4-f6hx
crates.io capnp < 0.13.7 0.13.7 GHSA-qqff-4vw4-f6hx
crates.io capnp >= 0.0.0-0, < 0.13.7 · >= 0.14.0-0, < 0.14.11 · >= 0.15.0-0, < 0.15.2 0.13.7, 0.14.11, 0.15.2 RUSTSEC-2022-0068

Advisories 4

References