Mercurial > hg > sv-dependency-builds
annotate src/capnproto-0.6.0/security-advisories/2015-03-05-0-c++-addl-cpu-amplification.md @ 62:0994c39f1e94
Cap'n Proto v0.6 + build for OSX
| author | Chris Cannam <cannam@all-day-breakfast.com> |
|---|---|
| date | Mon, 22 May 2017 10:01:37 +0100 |
| parents | |
| children |
| rev | line source |
|---|---|
| cannam@62 | 1 Problem |
| cannam@62 | 2 ======= |
| cannam@62 | 3 |
| cannam@62 | 4 CPU usage amplification attack, similar to previous vulnerability |
| cannam@62 | 5 [2015-03-02-2][1]. |
| cannam@62 | 6 |
| cannam@62 | 7 Discovered by |
| cannam@62 | 8 ============= |
| cannam@62 | 9 |
| cannam@62 | 10 David Renshaw <david@sandstorm.io> |
| cannam@62 | 11 |
| cannam@62 | 12 Announced |
| cannam@62 | 13 ========= |
| cannam@62 | 14 |
| cannam@62 | 15 2015-03-05 |
| cannam@62 | 16 |
| cannam@62 | 17 CVE |
| cannam@62 | 18 === |
| cannam@62 | 19 |
| cannam@62 | 20 CVE-2015-2313 |
| cannam@62 | 21 |
| cannam@62 | 22 Impact |
| cannam@62 | 23 ====== |
| cannam@62 | 24 |
| cannam@62 | 25 - Remotely cause a peer to execute a tight `for` loop counting from 0 to |
| cannam@62 | 26 2^29, possibly repeatedly, by sending it a small message. This could enable |
| cannam@62 | 27 a DoS attack by consuming CPU resources. |
| cannam@62 | 28 |
| cannam@62 | 29 Fixed in |
| cannam@62 | 30 ======== |
| cannam@62 | 31 |
| cannam@62 | 32 - git commit [80149744bdafa3ad4eedc83f8ab675e27baee868][0] |
| cannam@62 | 33 - release 0.5.1.2: |
| cannam@62 | 34 - Unix: https://capnproto.org/capnproto-c++-0.5.1.2.tar.gz |
| cannam@62 | 35 - Windows: https://capnproto.org/capnproto-c++-win32-0.5.1.2.zip |
| cannam@62 | 36 - release 0.4.1.1: |
| cannam@62 | 37 - Unix: https://capnproto.org/capnproto-c++-0.4.1.2.tar.gz |
| cannam@62 | 38 - release 0.6 (future) |
| cannam@62 | 39 |
| cannam@62 | 40 [0]: https://github.com/sandstorm-io/capnproto/commit/80149744bdafa3ad4eedc83f8ab675e27baee868 |
| cannam@62 | 41 |
| cannam@62 | 42 Details |
| cannam@62 | 43 ======= |
| cannam@62 | 44 |
| cannam@62 | 45 Advisory [2015-03-02-2][1] described a bug allowing a remote attacker to |
| cannam@62 | 46 consume excessive CPU time or other resources using a specially-crafted message. |
| cannam@62 | 47 The present advisory is simply another case of the same bug which was initially |
| cannam@62 | 48 missed. |
| cannam@62 | 49 |
| cannam@62 | 50 The new case occurs only if the application invokes the `totalSize()` method |
| cannam@62 | 51 on an object reader. |
| cannam@62 | 52 |
| cannam@62 | 53 The new case is somewhat less severe, in that it only spins in a tight `for` |
| cannam@62 | 54 loop that doesn't call any application code. Only CPU time is possibly |
| cannam@62 | 55 consumed, not RAM or other resources. However, it is still possible to create |
| cannam@62 | 56 significant delays for the receiver with a specially-crafted message. |
| cannam@62 | 57 |
| cannam@62 | 58 [1]: https://github.com/sandstorm-io/capnproto/blob/master/security-advisories/2015-03-02-2-all-cpu-amplification.md |
| cannam@62 | 59 |
| cannam@62 | 60 Preventative measures |
| cannam@62 | 61 ===================== |
| cannam@62 | 62 |
| cannam@62 | 63 Our fuzz test actually covered this case, but we didn't notice the problem |
| cannam@62 | 64 because the loop actually completes in less than a second. We've added a new |
| cannam@62 | 65 test case which is more demanding, and will make sure that when we do extended |
| cannam@62 | 66 testing with American Fuzzy Lop, we treat unexpectedly long run times as |
| cannam@62 | 67 failures. |