GHSA-q264-w97q-q778

Source

https://github.com/advisories/GHSA-q264-w97q-q778

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-q264-w97q-q778/GHSA-q264-w97q-q778.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-q264-w97q-q778

Aliases

Related

CVE-2023-23625

Published

2023-02-10T23:08:06Z

Modified

2024-05-20T21:43:31Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Denial of service via HAMT Decoding Panics

Details

Impact

Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic.

This is caused by bogus fanout parameter in the HAMT directory nodes. This include checks returned in ipfs/go-bitfield GHSA-2h6c-j3gf-xp9r, as well as limiting the fanout to <= 1024 (to avoid attempts of arbitrary sized allocations).

Patches

https://github.com/ipfs/go-unixfs/commit/dbcc43ec3e2db0d01e8d80c55040bba3cf22cb4b

Workarounds

Do not feed untrusted user data to the decoding functions.

References

https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r

Database specific

{
    "nvd_published_at": "2023-02-09T21:15:00Z",
    "cwe_ids": [
        "CWE-400"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-10T23:08:06Z"
}

References

Affected packages

Go / github.com/ipfs/go-unixfs

Package

Name: github.com/ipfs/go-unixfs; View open source insights on deps.dev
Purl: pkg:golang/github.com/ipfs/go-unixfs

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.3