Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xMjY0LXc5N3EtcTc3OM4AAxiG

Denial of service via HAMT Decoding Panics

Impact

Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks.
If you are reading untrusted user input, an attacker can then trigger a panic.

This is caused by bogus fanout parameter in the HAMT directory nodes.
This include checks returned in ipfs/go-bitfield GHSA-2h6c-j3gf-xp9r, as well as limiting the fanout to <= 1024 (to avoid attempts of arbitrary sized allocations).

Patches

• https://github.com/ipfs/go-unixfs/commit/dbcc43ec3e2db0d01e8d80c55040bba3cf22cb4b

Workarounds

Do not feed untrusted user data to the decoding functions.

References

• https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r

Permalink: https://github.com/advisories/GHSA-q264-w97q-q778
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xMjY0LXc5N3EtcTc3OM4AAxiG
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: 11 months ago

CVSS Score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-q264-w97q-q778, CVE-2023-23625
References:

• https://github.com/ipfs/go-unixfs/security/advisories/GHSA-q264-w97q-q778
• https://nvd.nist.gov/vuln/detail/CVE-2023-23625
• https://github.com/ipfs/go-unixfs/commit/467d139a640ecee4f2e74643dafcc58bb3b54175
• https://pkg.go.dev/vuln/GO-2023-1557
• https://github.com/advisories/GHSA-q264-w97q-q778

Repository: https://github.com/ipfs/go-unixfs
Blast Radius: 17.7

Affected Packages