Open hackersontwohouse opened 1 month ago
Is there an upstream PR for https://github.com/bytecodealliance/rustix that references this? Especially if you're CVSS scoring it I'm surprised to not see any mention in the changelogs.
Hi thanks for the respond, sry for CVSS is typo
Description 🐛
When using rustix::fs::Dir using the linux_raw backend, it's possible for the iterator to "get stuck" when an IO error is encountered. Combined with a memory over-allocation issue in rustix::fs::Dir::read_more, this can cause quick and unbounded memory explosion (gigabytes in a few seconds if used on a hot path) and eventually lead to an OOM crash of the application.
Since
<Dir as Iterator>::next
callsDir::read
, which in turn callsDir::read_more
, this means an IO error encountered during reading a directory can lead to rapid and unbounded growth of memory use.PoC:
If a program tries to access a directory with its file descriptor after the file has been unlinked (or any other action that leaves the Dir iterator in the stuck state), and the implementation does not break after seeing an error, it can cause a memory explosion. An attacker knowledgeable about the implementation details of a vulnerable target can therefore try to trigger this fault condition via any one or a combination of several available APIs. If successful, the application host will quickly run out of memory, after which the application will likely be terminated by an OOM killer, leading to denial of service.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H