CVE-2019-16226

py-lmdb version 0.97 contains a memory corruption vulnerability in the mdb_node_del function. The root cause is a missing validation of a memmove operation when an unexpected node->mn_hi value is encountered [1]. This flaw can lead to an invalid write operation when processing a malformed database file.

Exploitation

The vulnerability is triggered when an application using py-lmdb 0.97 opens a specially crafted data.mdb file supplied by an attacker [1]. No authentication is required if the attacker can provide the malicious file to the victim application. The issue lies in the LMDB library's internals and has been documented alongside related bugs [2]. Proof-of-concept code is publicly available [4].

Impact

Successful exploitation can result in memory corruption, potentially leading to application crashes or arbitrary code execution. The exact impact depends on how the malformed node data is interpreted by the memmove call [3].

Mitigation

Users should upgrade py-lmdb to a version that includes the fix for this issue. As of the publication date, no official patch has been released; the issue is tracked in the project's issue tracker [2]. Until a patched version is available, avoid opening untrusted LMDB files.