Rust-WebSocket up to 0.26.4 Untrusted Source Vec::with_capacity resource consumption

Summaryinfo

A vulnerability has been found in Rust-WebSocket up to 0.26.4 and classified as problematic. This vulnerability affects the function Vec::with_capacity of the component Untrusted Source Handler. The manipulation leads to resource consumption. This vulnerability is traded as CVE-2022-35922. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Rust-WebSocket up to 0.26.4 and classified as problematic. This issue affects the function Vec::with_capacity of the component Untrusted Source Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory (OOM) process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based on the declared dataframe size, which may come from an untrusted source. When `Vec::with_capacity` fails to allocate, the default Rust allocator will abort the current process, killing all threads. This affects only sync (non-Tokio) implementation. Async version also does not limit memory, but does not use `with_capacity`, so DoS can happen only when bytes for oversized dataframe or message actually got delivered by the attacker. The crashes are fixed in version 0.26.5 by imposing default dataframe size limits. Affected users are advised to update to this version. Users unable to upgrade are advised to filter websocket traffic externally or to only accept trusted traffic.

The weakness was shared 08/02/2022 as GHSA-qrjv-rf5q-qpxc. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2022-35922 since 07/15/2022. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 0.26.5 eliminates this vulnerability. Applying the patch cbf6e9983e839d2ecad86de8cd1b3f20ed43390b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Rust-WebSocket

Version

• 0.26.0
• 0.26.1
• 0.26.2
• 0.26.3
• 0.26.4

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion