Description
apitrace 2.0 through 14.0 contains a heap-based buffer overflow in SnappyFile::flushReadCache() that allows attackers to write past m_compressedCache via an oversized compressed chunk length. Attackers can supply a crafted .trace file whose 4-byte chunk length exceeds the fixed buffer size, corrupting heap memory when users dump, inspect, or replay it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| apitrace | apitrace | 2.0 – ≤ 14.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apitrace | No fix yet | — |
| Debian 13 | apitrace | No fix yet | — |
| Debian 12 | apitrace | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | apitrace | No fix yet | — |
| Ubuntu 26.04 LTS | apitrace | No fix yet | — |
| Ubuntu 24.04 LTS | apitrace | No fix yet | — |
| Ubuntu 20.04 LTS | apitrace | No fix yet | — |
| Ubuntu 18.04 LTS | apitrace | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | apitrace | No fix yet | — |
References
- https://github.com/apitrace/apitrace/commit/3890c5a448addfd75ccbe1bd09e3075de6fb3395 patch
- https://github.com/apitrace/apitrace/blob/18cfd388ac47a9e00978b34d6c20341f3e2cdb56/lib/trace/trace_file_snappy.cpp#L215-L235 technical-description
- VulnCheck Advisory: apitrace 2.0 through 14.0 Heap Buffer Overflow via SnappyFile::flushReadCache() third-party-advisory