go-unixfsnode up to 1.5.1 HAMT Sharded Directory fanout resource consumption

Summaryinfo

A vulnerability was found in go-unixfsnode up to 1.5.1 and classified as problematic. The impacted element is an unknown function of the component HAMT Sharded Directory Handler. Executing a manipulation of the argument fanout can lead to resource consumption. This vulnerability is handled as CVE-2023-23631. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in go-unixfsnode up to 1.5.1 (Operating System). This vulnerability affects an unknown code of the component HAMT Sharded Directory Handler. The manipulation of the argument fanout with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. CVE summarizes:

github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus fanout parameter in the HAMT directory nodes. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was released 02/10/2023 as GHSA-4gj3-6r43-3wfc. The advisory is available at github.com. This vulnerability was named CVE-2023-23631 since 01/16/2023. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Upgrading to version 1.5.2 eliminates this vulnerability. Applying the patch 59050ea8bc458ae55246ae09243e6e165923e076 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Name

• go-unixfsnode

Version

• 1.5.0
• 1.5.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion