CVE-2024-3204: 
NixOS vulnerability analysis and mitigation

A critical vulnerability has been identified in c-blosc2 versions up to 2.13.2, affecting the ndlz4_decompress function in /src/c-blosc2/plugins/codecs/ndlz/ndlz4x4.c. The vulnerability was discovered and publicly disclosed in April 2024 (NVD).

The vulnerability is classified as a heap-based buffer overflow (CWE-122) in the ndlz4_decompress function. It has received a CVSS v3.1 base score of 7.3 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating that it can be exploited remotely with low attack complexity and requires no privileges or user interaction (NVD).

The vulnerability allows remote attackers to potentially execute arbitrary code or cause denial of service through heap-based buffer overflow exploitation. The impact affects confidentiality, integrity, and availability of the system, each rated as Low according to the CVSS score (NVD).

The vulnerability can be exploited remotely, and according to the advisory, the exploit has been disclosed to the public and may be used. The attack complexity is considered low, requiring no special privileges or user interaction (NVD).

The vulnerability has been addressed in version 2.14.3 of c-blosc2. Users are strongly recommended to upgrade to this version to mitigate the risk (GitHub Release).