GHSA-q264-w97q-q778
Suggest an improvement- Source
- https://github.com/advisories/GHSA-q264-w97q-q778
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-q264-w97q-q778/GHSA-q264-w97q-q778.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-q264-w97q-q778
- Aliases
- Published
- 2023-02-10T23:08:06Z
- Modified
- 2024-05-20T21:43:31Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Denial of service via HAMT Decoding Panics
- Details
-
Impact
Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic.
This is caused by bogus
fanoutparameter in the HAMT directory nodes. This include checks returned in ipfs/go-bitfield GHSA-2h6c-j3gf-xp9r, as well as limiting thefanoutto<= 1024(to avoid attempts of arbitrary sized allocations).Patches
- https://github.com/ipfs/go-unixfs/commit/dbcc43ec3e2db0d01e8d80c55040bba3cf22cb4b
Workarounds
Do not feed untrusted user data to the decoding functions.
References
- https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r
- Database specific
{ "nvd_published_at": "2023-02-09T21:15:00Z", "severity": "MODERATE", "cwe_ids": [ "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2023-02-10T23:08:06Z" }- References
-
- https://github.com/ipfs/go-unixfs/security/advisories/GHSA-q264-w97q-q778
- https://nvd.nist.gov/vuln/detail/CVE-2023-23625
- https://github.com/ipfs/go-unixfs/commit/467d139a640ecee4f2e74643dafcc58bb3b54175
- https://github.com/advisories/GHSA-q264-w97q-q778
- https://github.com/ipfs/go-unixfs
- https://pkg.go.dev/vuln/GO-2023-1557
Affected packages
Go / github.com/ipfs/go-unixfs
Package
- Name
- github.com/ipfs/go-unixfs
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/ipfs/go-unixfs