GHSA-3gjh-29fv-8hr6 Nervos CKB Snappy decompress length can be very large and causes out of memory error
An attacker can cause a denial of service by sending compressed messages that expand to consume excessive memory, crashing the Nervos CKB node.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-3gjh-29fv-8hr6?
GHSA-3gjh-29fv-8hr6 is a denial of service vulnerability in ckb, published on 3 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Adversary can create message which compressed size is less than the package limit but the decompressed length is very large such as 1G. It will cost the node many memories to process the network messages, and on the system with less than 1G memory, the process is killed directly because of out of memory error.
Patches
The node must check the decompress length before allocating the memory for the message.
References
Which versions are affected by GHSA-3gjh-29fv-8hr6?
2 open source packages ship an affected version, including ckb.
| Package | Affected | Fixed in |
|---|---|---|
ckb crates.io | All versions | 0.34.2 |
ckb crates.io | All versions | 0.34.2 |
How do I fix GHSA-3gjh-29fv-8hr6?
Upgrade ckb to 0.34.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-3gjh-29fv-8hr6 being exploited?
There is no known exploitation of GHSA-3gjh-29fv-8hr6 in the wild and no public exploit code.