CVE-2019-15788

Vulnerability

Clara Genomics Analysis before version 0.2.0 contains an integer overflow vulnerability in the memory management code within allocate_block.cpp of the cudapoa module [1][2]. The overflow occurs when calculating memory sizes, potentially allowing an attacker to bypass intended capacity limits.

Exploitation

An attacker would need to provide specially crafted input to the cudapoa module that triggers the integer overflow, leading to undersized memory allocation. The condition requires the attacker to control or influence the size calculations that lead to the overflow.

Impact

Successful exploitation could result in a heap-based buffer overflow, potentially leading to arbitrary code execution, denial of service, or information disclosure, depending on the memory layout and attacker control.

Mitigation

The issue was fixed in Clara Genomics Analysis version 0.2.0 via pull request #70 [1]. Users should upgrade to version 0.2.0 or later. No other mitigations are available for earlier versions.