CVE-2023-28638: 
C# vulnerability analysis and mitigation

Snappier, a high-performance C# implementation of the Snappy compression algorithm, was found to contain a buffer overrun vulnerability (CVE-2023-28638) affecting version 1.1.0. The vulnerability was discovered and disclosed on March 27, 2023. The issue arose from a code rewrite that switched from using pinned buffers to byte references, which could potentially become invalid during garbage collection compaction (GitHub Advisory).

The vulnerability occurs when byte references briefly point outside valid buffer areas during buffer range checks. The .NET garbage collector can only update byte references during compaction if they point within the buffer or exactly one byte past the end. If references point outside this area, the buffer may be moved while the reference remains unchanged, potentially invalidating buffer range checks and allowing buffer overruns. This issue is particularly concerning because one of the problematic range checks is based on input data in the decompression buffer, making it potentially exploitable through malformed input data (GitHub Advisory). The vulnerability has been assigned a CVSS v3.1 base score of 7.0 HIGH (NVD).

The primary impact of this vulnerability is the potential for buffer overruns, which would likely result in access to protected memory. When such access occurs, it typically triggers an exception and causes the process to terminate, effectively creating a denial of service condition. While more severe exploitation might be theoretically possible, the most probable outcome is service disruption (GitHub Advisory).

The vulnerability has been patched in release 1.1.1, and users are strongly advised to upgrade to this version. For users unable to upgrade immediately, a partial workaround exists: buffers can be pinned to a fixed location before using them for compression or decompression. However, this workaround is not completely effective as at least one temporary decompression buffer internal to the library is never pinned (GitHub Advisory).