CVE-2023-23625 Denial of service in HAMT Decoding in go-unixfs
Attackers can cause denial of service via panics and memory leaks by providing malformed HAMT directory data to the go-unixfs library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-23625?
CVE-2023-23625 is a medium-severity denial of service vulnerability in ipfs go-unixfs, published on 9 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.
Weakness: CWE-400
Which versions are affected by CVE-2023-23625?
3 open source packages ship an affected version, including github.com/ipfs/go-unixfs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ipfs/go-unixfs Go | All versions | 0.4.3 |
github.com/ipfs/go-unixfs Go | All versions | 0.4.3 |
github.com/ipfs/go-unixfs Go | All versions | 0.4.3 |
Products include Protocol Go-Unixfs.
How do I fix CVE-2023-23625?
Upgrade github.com/ipfs/go-unixfs to 0.4.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-23625 being exploited?
There is no known exploitation of CVE-2023-23625 in the wild and no public exploit code.
Sources
Also known as GHSA-q264-w97q-q778, GO-2023-1557.