54 lines
No EOL
1.9 KiB
Markdown
54 lines
No EOL
1.9 KiB
Markdown
Problem
|
|
=======
|
|
|
|
Insufficient validation of message metadata with negative segment sizes may lead to excessive memory allocation and
|
|
subsequent DoS.
|
|
|
|
Discovered by
|
|
=============
|
|
|
|
Martin Dindoffer <contact@dindoffer.eu>
|
|
|
|
Announced
|
|
=========
|
|
|
|
2021-09-30
|
|
|
|
Impact
|
|
======
|
|
|
|
It is possible for an attacker to craft a malicious message that may thanks to memory amplification lead to a Denial of
|
|
Service attack against the consumer of CapnProto messages. In practical terms a message of only 8 bytes may cause
|
|
allocation of 2GB of memory.
|
|
|
|
CVSS score
|
|
==========
|
|
|
|
7.5 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
|
|
|
Fixed in
|
|
========
|
|
|
|
Release 0.1.11
|
|
|
|
Details
|
|
=======
|
|
|
|
A read of 4 bytes from the message is performed, the result of which is read as the size of a segment in a variable.
|
|
This size is stored in memory as a signed integer. If the segment count is 1, the size of the first segment is also
|
|
considered to be the total size of the message stored in a totalWords variable. Since both the segment0Size and the
|
|
totalWords are signed integers, they may hold a negative number which will pass the traversal limit check.
|
|
|
|
Subsequently capnproto-java tries to allocate enough memory for the segment. Because the encoded size is in words, the
|
|
value is multiplied by the number 8. The resulting number is used as the size of a ByteBuffer allocated for the first
|
|
segment. A sufficiently large negative number when multiplied by 8 will net a large positive integer, thus causing large
|
|
memory allocation in the form of a ByteBuffer.
|
|
|
|
A segment size of `-1 879 048 193` multiplied by 8 results in `2 147 483 640` bytes of allocated memory, which is close
|
|
to `Integer.MAX_VALUE` and around the size of the maximum length of a Java array. Therefore the maximum size a message
|
|
may allocate this way is roughly 2GB.
|
|
|
|
Remediation
|
|
===========
|
|
|
|
Stricter validation refusing negative segment sizes was implemented. |