PT-2023-20166 · Boxo · Boxo

Jorropo · Published 2023-05-10 · Updated 2023-06-14 · CVE-2023-25568

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Boxo versions 0.4.0 through 0.5.0

Description An attacker can cause a Bitswap server to allocate and leak unbounded amounts of memory by sending many WANT BLOCK and or WANT HAVE requests which are queued in an unbounded queue, with allocations that persist even if the connection is closed. This affects users accepting untrusted connections with the Bitswap server and also affects users using the old API stubs at github.com/ipfs/go-libipfs/bitswap because users then transitively import github.com/ipfs/go-libipfs/bitswap/server.

Recommendations Update Boxo to version 0.6.0 or later Update Boxo to version 0.4.1 As a temporary workaround, consider refactoring your code to use the new split API that will allow you to run in a client-only mode using: github.com/ipfs/boxo/bitswap/client. The server now limits how many wantlist entries per peer it knows, and this can be configured using the MaxQueuedWantlistEntriesPerPeer option. The server now properly clears state about peers when they disconnect. The server now ignores CIDs above some size, and this can be configured using the MaxCidSize option. The server now closes the connection if an inline CID is requested.

Exploit

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2023-25568

GHSA-M974-XJ4J-7QV5

GHSA-Q3J6-22WF-3JH9

GHSA-QVQG-6RP8-4P9H

GO-2023-1766

Affected Products

Boxo

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25568.json · Exploit
• https://github.com/ipfs/go-libipfs/security/advisories/GHSA-m974-xj4j-7qv5 · Vendor Advisory
• https://github.com/ipfs/boxo/commit/9cb5cb54d40b57084d1221ba83b9e6bb3fcc3197 · Patch
• https://github.com/ipfs/boxo/commit/62cbac40b96f49e39cd7fedc77ee6b56adce4916 · Patch
• https://github.com/ipfs/boxo/commit/baa748b682fabb21a4c1f7628a8af348d4645974 · Patch
• https://osv.dev/vulnerability/CVE-2023-25568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25568 · Security Note
• https://osv.dev/vulnerability/GHSA-qvqg-6rp8-4p9h · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1766 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m974-xj4j-7qv5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q3j6-22wf-3jh9 · Vendor Advisory
• https://github.com/ipfs/kubo/security/advisories/GHSA-qvqg-6rp8-4p9h · Note
• https://github.com/ipfs/kubo · Note
• https://github.com/ipfs/go-bitswap · Note
• https://github.com/ipfs/go-bitswap/security/advisories/GHSA-q3j6-22wf-3jh9 · Note