PT-2024-25032 · Yamux · Yamux

Agemanning + 1 · Published 2024-05-01 · Updated 2024-05-02 · CVE-2024-32984

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Yamux (affected versions not specified)

Description Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. The Rust implementation of the Yamux stream multiplexer uses a vector for pending frames, which is not bounded in length. This vector can be remotely triggered to grow indefinitely by opening a new libp2p Identify stream or sending a Yamux Ping frame, causing the node to send its Identify message or a Pong frame, respectively. An attacker can use TCP's receive window mechanism to prevent the victim from sending out any data, leading to a memory overflow. This can result in the corresponding process getting terminated by the operating system. Depending on the application protocols running on top of rust-libp2p, higher amplification factors are possible, and the attack also drives up the victim's CPU load.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-32984

GHSA-3999-5FFV-WP2R

Affected Products

Yamux

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32984.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-32984 · Security Note
• https://osv.dev/vulnerability/GHSA-3999-5ffv-wp2r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32984 · Vendor Advisory
• https://github.com/libp2p/rust-yamux · Note
• https://github.com/libp2p/rust-yamux/security/advisories/GHSA-3999-5ffv-wp2r · Note
• https://github.com/libp2p/rust-yamux/blob/yamux-v0.13.1/yamux/src/connection.rs#L289 · Note
• https://github.com/libp2p/rust-yamux/commit/460baf2ccb7d5982b266cb3cb9c0bdf75b4fb779 · Note
• https://github.com/sigp/rust-yamux/commit/6689e227a48258a52347cd1d984adfc94afc6f7a · Note
• https://twitter.com/linuxpatch/status/1785642082033349027 · Twitter Post
• https://twitter.com/cracbot/status/1785957006362235001 · Twitter Post
• https://t.me/cvenotify/78674 · Telegram Post
• https://twitter.com/CVEnew/status/1785647581827330394 · Twitter Post