GHSA-pm3m-32r3-7mfh Etcd embed auto compaction retention negative value causing a compaction loop or a crash
An attacker can cause a denial of service in etcd by providing a negative compaction retention value, leading to high CPU usage and log spam.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-pm3m-32r3-7mfh?
GHSA-pm3m-32r3-7mfh is a denial of service vulnerability in go.etcd.io/etcd, published on 3 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Data Validation
Detail
The parseCompactionRetention function in embed/etcd.go allows the retention variable value to be negative and causes the node to execute the history compaction in a loop, taking more CPU than usual and spamming logs.
References
Find out more on this vulnerability in the security audit report
For more information
If you have any questions or comments about this advisory:
- Contact the etcd security committee
Which versions are affected by GHSA-pm3m-32r3-7mfh?
6 open source packages ship an affected version, including go.etcd.io/etcd/v3 and go.etcd.io/etcd.
| Package | Affected | Fixed in |
|---|---|---|
go.etcd.io/etcd/v3 Go | All versions | None |
go.etcd.io/etcd/v3 Go | All versions | 3.3.23 |
go.etcd.io/etcd/v3 Go | All versions | 3.3.23 |
go.etcd.io/etcd/v3 Go | From 3.4.0-rc.0 | 3.4.10 |
go.etcd.io/etcd/v3 Go | From 3.4.0-rc.0 | 3.4.10 |
go.etcd.io/etcd Go | All versions | None |
How do I fix GHSA-pm3m-32r3-7mfh?
Upgrade go.etcd.io/etcd/v3 to a fixed version for your release line: 3.3.23 or 3.4.10.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-pm3m-32r3-7mfh being exploited?
There is no known exploitation of GHSA-pm3m-32r3-7mfh in the wild and no public exploit code.
Sources
Also known as GO-2024-2529.