GHSA-m6m5-pp4g-fcc8 S3 storage write is not aborted on errors leading to unbounded memory usage

Not scored Published 6 Oct 2021

An attacker can cause unbounded memory usage and denial of service by triggering errors during S3 storage writes in the maddy mail server.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-m6m5-pp4g-fcc8?

GHSA-m6m5-pp4g-fcc8 is a denial of service vulnerability in github.com/foxcpp/maddy, published on 6 Oct 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Impact

Anyone using storage.blob.s3 introduced in 0.5.0 with storage.imapsql.

storage.imapsql local_mailboxes {
  ...
  msg_store s3 {
    ...
  }
}

Patches

The relevant commit is pushed to master and will be included in the 0.5.1 release.

No special handling of the issue has been done due to the small amount of affected users.

Workarounds

None.

References

Original report: https://github.com/foxcpp/maddy/issues/395
Fix: https://github.com/foxcpp/maddy/commit/07c8495ee4394fabbf5aac4df8aebeafb2fb29d8

Which versions are affected by GHSA-m6m5-pp4g-fcc8?

3 open source packages ship an affected version, including github.com/foxcpp/maddy.

Package	Affected	Fixed in
`github.com/foxcpp/maddy` Go	All versions	`0.5.1`
`github.com/foxcpp/maddy` Go	All versions	`0.5.1`
`github.com/foxcpp/maddy` Go	All versions	`0.5.1`

How do I fix GHSA-m6m5-pp4g-fcc8?

Upgrade github.com/foxcpp/maddy to 0.5.1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is GHSA-m6m5-pp4g-fcc8 being exploited?

There is no known exploitation of GHSA-m6m5-pp4g-fcc8 in the wild and no public exploit code.

Sources

Also known as GO-2022-0374.