High, CVSS 7.5crates.ioPublished
Remote DoS through unchecked IdList allocation in negentropy
- Affected
- crates.io negentropy >= 0.2.0, < 0.4.4; >= 0.5.0, < 0.5.2
- Fixed in
- 0.4.40.5.2· Vendor fix available
- Issue
- The `negentropy` crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages. With the `std` feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application. Details When processing an `IdList` range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs: ```rust let mut their_elems: HashSet = HashSet::with_capacity(num_ids as usize); ``` An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message. With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, `catch_unwind` cannot contain the failure. Both `reconcile` and `reconcile_with_ids` reach…
Recommended action: Upgrade to 0.5.2 or 0.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.