CVE-2023-23626Medium· 5.9▾ SunlitIPFS go-bitfield vulnerable to DoS via malformed size arguments
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.9%
When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics.
This happen when the size is a not a multiple of 8 or is negative.
There were already a note in the NewBitfield documentation:
Panics if size is not a multiple of 8.
But it incomplete and missing from FromBytes's documentation.
This has been replaced by returning an (Bitfield, error) and returning a non nil error if the size is wrong.
size%8 == 0 && size >= 0 yourself before calling NewBitfield or FromBytesgithub.com/ipfs/go-bitfield < 1.1.0Upgrade to a patched release:
github.com/ipfs/go-bitfield 1.1.0Connected by shared product, vendor, weakness, or advisory.