CVE-2022-36078 Slice Memory Allocation with Excessive Size Value in binary
Attackers can cause denial of service by triggering excessive memory allocation when parsing untrusted data with the binary library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-36078?
CVE-2022-36078 is a high-severity denial of service vulnerability in gagliardetto binary, published on 2 Sep 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Binary provides encoding/decoding in Borsh and other formats. The vulnerability is a memory allocation vulnerability that can be exploited to allocate slices in memory with (arbitrary) excessive size value, which can either exhaust available memory or crash the whole program. When using `github.com/gagliardetto/binary` to parse unchecked (or wrong type of) data from untrusted sources of input (e.g. the blockchain) into slices, it's possible to allocate memory with excessive size. When `dec.Decode(&val)` method is used to parse data into a structure that is or contains slices of values, the length of the slice was previously read directly from the data itself without any checks on the size of it, and then a slice was allocated. This could lead to an overflow and an allocation of memory with excessive size value. Users should upgrade to `v0.7.1` or higher. A workaround is not to rely on the `dec.Decode(&val)` function to parse the data, but to use a custom `UnmarshalWithDecoder()` method that reads and checks the length of any slice.
Which versions are affected by CVE-2022-36078?
3 open source packages ship an affected version, including github.com/gagliardetto/binary. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gagliardetto/binary Go | All versions | 0.7.1 |
github.com/gagliardetto/binary Go | All versions | 0.7.1 |
github.com/gagliardetto/binary Go | All versions | 0.7.1 |
Products include Binary Project Binary.
How do I fix CVE-2022-36078?
Upgrade github.com/gagliardetto/binary to 0.7.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-36078 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-36078 exists.
Sources
Also known as GHSA-4p6f-m4f9-ch88, GO-2022-0963.