bytecodealliance rustix up to 0.35.14/0.36.15/0.37.24/0.38.18 rustix::fs::Dir resource consumption

Summaryinfo

A vulnerability was found in bytecodealliance rustix up to 0.35.14/0.36.15/0.37.24/0.38.18. It has been classified as problematic. This vulnerability affects the function rustix::fs::Dir. The manipulation leads to resource consumption. This vulnerability is documented as CVE-2024-43806. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in bytecodealliance rustix up to 0.35.14/0.36.15/0.37.24/0.38.18. This issue affects the function rustix::fs::Dir. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

Rustix is a set of safe Rust bindings to POSIX-ish APIs. When using `rustix::fs::Dir` using the `linux_raw` backend, it's possible for the iterator to "get stuck" when an IO error is encountered. Combined with a memory over-allocation issue in `rustix::fs::Dir::read_more`, this can cause quick and unbounded memory explosion (gigabytes in a few seconds if used on a hot path) and eventually lead to an OOM crash of the application. The symptoms were initially discovered in https://github.com/imsnif/bandwhich/issues/284. That post has lots of details of our investigation. Full details can be read on the GHSA-c827-hfw6-qwvm repo advisory. If a program tries to access a directory with its file descriptor after the file has been unlinked (or any other action that leaves the `Dir` iterator in the stuck state), and the implementation does not break after seeing an error, it can cause a memory explosion. As an example, Linux's various virtual file systems (e.g. `/proc`, `/sys`) can contain directories that spontaneously pop in and out of existence. Attempting to iterate over them using `rustix::fs::Dir` directly or indirectly (e.g. with the `procfs` crate) can trigger this fault condition if the implementation decides to continue on errors. An attacker knowledgeable about the implementation details of a vulnerable target can therefore try to trigger this fault condition via any one or a combination of several available APIs. If successful, the application host will quickly run out of memory, after which the application will likely be terminated by an OOM killer, leading to denial of service. This issue has been addressed in release versions 0.35.15, 0.36.16, 0.37.25, and 0.38.19. Users are advised to upgrade. There are no known workarounds for this issue.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-43806 since 08/16/2024. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 207680 (SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rage-encryption (SUSE-SU-2024:3404-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.35.15, 0.36.16, 0.37.25 or 0.38.19 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (207680). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• bytecodealliance

Name

• rustix

Version

• 0.35.0
• 0.35.1
• 0.35.2
• 0.35.3
• 0.35.4
• 0.35.5
• 0.35.6
• 0.35.7
• 0.35.8
• 0.35.9
• 0.35.10
• 0.35.11
• 0.35.12
• 0.35.13
• 0.35.14
• 0.36.0
• 0.36.1
• 0.36.2
• 0.36.3
• 0.36.4
• 0.36.5
• 0.36.6
• 0.36.7
• 0.36.8
• 0.36.9
• 0.36.10
• 0.36.11
• 0.36.12
• 0.36.13
• 0.36.14
• 0.36.15
• 0.37.0
• 0.37.1
• 0.37.2
• 0.37.3
• 0.37.4
• 0.37.5
• 0.37.6
• 0.37.7
• 0.37.8
• 0.37.9
• 0.37.10
• 0.37.11
• 0.37.12
• 0.37.13
• 0.37.14
• 0.37.15
• 0.37.16
• 0.37.17
• 0.37.18
• 0.37.19
• 0.37.20
• 0.37.21
• 0.37.22
• 0.37.23
• 0.37.24
• 0.38.0
• 0.38.1
• 0.38.2
• 0.38.3
• 0.38.4
• 0.38.5
• 0.38.6
• 0.38.7
• 0.38.8
• 0.38.9
• 0.38.10
• 0.38.11
• 0.38.12
• 0.38.13
• 0.38.14
• 0.38.15
• 0.38.16
• 0.38.17
• 0.38.18

Website

• Product: https://github.com/bytecodealliance/rustix/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion