PT-2023-19092 · Unknown · Go-Unixfsnode

Jorropo · Published 2023-02-09 · Updated 2023-02-17 · CVE-2023-23631

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions go-unixfsnode versions prior to 1.5.2

Description The issue is caused by a bogus fanout parameter in the HAMT directory nodes, which can lead to panics and virtual memory leaks when trying to read malformed HAMT sharded directories. If untrusted user input is being read, an attacker can trigger a panic. This is a concern for users who are reading untrusted input.

Recommendations For versions prior to 1.5.2, users are advised to upgrade to version 1.5.2 or later to resolve the issue. As a temporary workaround, consider limiting the fanout to <= 1024 to avoid attempts of arbitrary sized allocations. There are no known workarounds other than upgrading.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2023-23631

GHSA-4GJ3-6R43-3WFC

GO-2023-1559

Affected Products

Go-Unixfsnode

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23631.json · Exploit
• https://github.com/ipfs/go-unixfsnode/commit/91b3d39d33ef0cd2aff2c95d50b2329350944b68 · Patch
• https://github.com/ipfs/go-unixfsnode/commit/59050ea8bc458ae55246ae09243e6e165923e076 · Patch
• https://github.com/ipfs/go-unixfsnode/security/advisories/GHSA-4gj3-6r43-3wfc · Vendor Advisory
• https://github.com/ipfs/go-unixfsnode/commit/a4ed723727e0bdc2277158337c2fc0d82802d122 · Patch
• https://osv.dev/vulnerability/GO-2023-1559 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23631 · Security Note
• https://osv.dev/vulnerability/GHSA-4gj3-6r43-3wfc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-23631 · Vendor Advisory
• https://github.com/ipfs/go-unixfsnode · Note
• https://pkg.go.dev/vuln/GO-2023-1559 · Note