@electron/packager's build process memory potentially leaked into final executable

Vulnerability

Overview

CVE-2024-29900 describes a memory disclosure vulnerability in Electron Packager, a tool that bundles Electron application source code into distributable executables. During the packaging process, a random segment of approximately 1-10 KB of Node.js heap memory allocated adjacent to a known buffer is inadvertently included in the final executable [1]. The root cause, as shown in the fix commit, involves improper handling of the integrity buffer where the original code directly serialized the asarIntegrity object without first extracting and filtering the necessary fields, leading to the inclusion of extraneous heap memory [4].

Exploitation

The vulnerability is exploitable by anyone who obtains a packaged executable created by an affected version of Electron Packager. No authentication or special network position is required; an attacker can simply analyze the binary file to extract the leaked memory region. The leaked data is a contiguous block of heap memory that may contain sensitive information such as environment variables, secrets files, or other in-memory data [3].

Impact

If an attacker successfully extracts the leaked memory, they could gain access to sensitive information that was present in the Node.js heap at the time of packaging. This could include API keys, database credentials, or other secrets, potentially leading to further compromise of the application or its associated services [1][3].

Mitigation

The issue is patched in Electron Packager version 18.3.1. According to the security advisory, there are no workarounds; users must update to the patched version immediately to prevent exposure [3]. The fix ensures that only the necessary integrity data is written to the executable, eliminating the heap memory leak [4].