CVE-2022-35922 Memory allocation based on untrusted length in rust-websocket

What is CVE-2022-35922?

CVE-2022-35922 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 1 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory (OOM) process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based on the declared dataframe size, which may come from an untrusted source. When `Vec::with_capacity` fails to allocate, the default Rust allocator will abort the current process, killing all threads. This affects only sync (non-Tokio) implementation. Async version also does not limit memory, but does not use `with_capacity`, so DoS can happen only when bytes for oversized dataframe or message actually got delivered by the attacker. The crashes are fixed in version 0.26.5 by imposing default dataframe size limits. Affected users are advised to update to this version. Users unable to upgrade are advised to filter websocket traffic externally or to only accept trusted traffic.

Weakness: CWE-770, CWE-400

Which versions are affected by CVE-2022-35922?

3 open source packages ship an affected version, including websocket. It affects 2 products.

Products include Fedoraproject Fedora, Rust-Websocket Project Rust-Websocket.

How do I fix CVE-2022-35922?

Upgrade websocket to 0.26.5 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-35922 being exploited?

There is no known exploitation of CVE-2022-35922 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2024-4577 PHP-CGI OS Command Injection Exploited Critical 9.8
• CVE-2021-39226 Grafana Authentication Bypass Exploited Critical 9.8
• CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Exploited Critical 9.8
• CVE-2024-4947 Google Chromium V8 Type Confusion Exploited Critical 9.6
• CVE-2024-4671 Google Chromium Visuals Use-After-Free Exploited Critical 9.6

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qrjv-rf5q-qpxc, RUSTSEC-2022-0035.