Medium, CVSS 6.5crates.ioPublished
rustix's rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion
CVE-2024-43806 · GHSA-c827-hfw6-qwvm
- Affected
- crates.io rustix >= 0.35.11, < 0.35.15; >= 0.36.0, < 0.36.16; >= 0.37.0, < 0.37.25; >= 0.38.0, < 0.38.19
- Fixed in
- 0.35.150.36.160.37.250.38.19· Vendor fix available
- Issue
- When using rustix::fs::Dir using the linuxraw backend, it's possible for the iterator to "get stuck" when an IO error is encountered. Combined with a memory over-allocation issue in rustix::fs::Dir::readmore, this can cause quick and unbounded memory explosion (gigabytes in a few seconds if used on a hot path) and eventually lead to an OOM crash of the application. Details Discovery The symptoms were initially discovered in https://github.com/imsnif/bandwhich/issues/284. That post has lots of details of our investigation. See this post and the Discord thread for details. Diagnosis This issue is caused by the combination of two independent bugs: 1. Stuck iterator - The rustix::fs::Dir iterator can fail to halt after encountering an IO error, causing the caller to be stuck in an infinite loop. 2. Memory over-allocation - Dir::readmore incorrectly grows the read buffer unconditionally each time it is called, regardless of necessity. Since <Dir as Iterator::next calls Dir::read,…
Recommended action: Upgrade to 0.38.19, 0.37.25, 0.36.16 or 0.35.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.