GHSA-mcrf-7hf9-f6q5 Unchecked vector pre-allocation
An attacker can cause denial of service by sending small msgpack messages that trigger excessive memory allocation in the Rust library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-mcrf-7hf9-f6q5?
GHSA-mcrf-7hf9-f6q5 is a denial of service vulnerability in rmpv, published on 21 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Affected versions of this crate pre-allocate memory on deserializing raw buffers without checking whether there is sufficient data available.
This allows an attacker to do denial-of-service attacks by sending small msgpack messages that allocate gigabytes of memory.
Which versions are affected by GHSA-mcrf-7hf9-f6q5?
3 open source packages ship an affected version, including rmpv.
| Package | Affected | Fixed in |
|---|---|---|
rmpv crates.io | All versions | 0.4.2 |
rmpv crates.io | All versions | 0.4.2 |
rmpv crates.io | From 0.0.0-0 | 0.4.2 |
How do I fix GHSA-mcrf-7hf9-f6q5?
Upgrade rmpv to 0.4.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-mcrf-7hf9-f6q5 being exploited?
There is no known exploitation of GHSA-mcrf-7hf9-f6q5 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2017-0006.