Medium, CVSS 5.5crates.ioPublished
Unbounded memory allocation in evtx parsing a .wevtcache file
- Affected
- crates.io evtx >= 0.11.0, < 0.15.1
- Fixed in
- 0.15.1· Vendor fix available
- Issue
- Affected versions of `evtx` did not bound a per-entry payload length read from a `.wevtcache` file before allocating a buffer sized from it, allowing a tiny crafted file to force a multi-gigabyte allocation and abort the process (out-of-memory denial of service, CWE-400). Details In `WevtCacheReader::next_entry` (`src/wevt_templates/wevtcache.rs`), the per-entry payload length is read as a `u64` straight from the file and used to size a zeroing buffer before any data is read: ```rust let len = usize::try_from(len_u64)?; // u64 taken directly from the entry header let mut buf = vec![0u8; len]; // unbounded allocation, sized from the file reader.read_exact(&mut buf)?; // only fails AFTER the allocation ``` The only check on `len` is that it fits in `usize`; there is no check that it fits within the bytes remaining in the file. An entry header declaring a ~4 GiB length therefore makes the crate request a ~4 GiB allocation from a file of only ~25 bytes. The sink is reachable…
Recommended action: Upgrade to 0.15.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.