CVE-2023-23631 HAMT Decoding Panics in github.com/ipfs/go-unixfsnode
Attackers can cause application crashes and memory leaks by providing malformed HAMT directory data to the go-unixfsnode library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-23631?
CVE-2023-23631 is a medium-severity denial of service vulnerability in ipfs go-unixfsnode, published on 9 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus fanout parameter in the HAMT directory nodes. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-400
Which versions are affected by CVE-2023-23631?
3 open source packages ship an affected version, including github.com/ipfs/go-unixfsnode. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ipfs/go-unixfsnode Go | All versions | 1.5.2 |
github.com/ipfs/go-unixfsnode Go | All versions | 1.5.2 |
github.com/ipfs/go-unixfsnode Go | All versions | 1.5.2 |
Products include Protocol Go-Unixfsnode.
How do I fix CVE-2023-23631?
Upgrade github.com/ipfs/go-unixfsnode to 1.5.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-23631 being exploited?
There is no known exploitation of CVE-2023-23631 in the wild and no public exploit code.
Sources
Also known as GHSA-4gj3-6r43-3wfc, GO-2023-1559.