CVE-2023-23631CWE-400

HAMT Decoding Panics in github.com/ipfs/go-unixfsnode

Medium · published February 9, 2023

CVSS v3.1
5.9
EPSS
1%
Percentile
59.5
In the wild
Unconfirmed
What it is

github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks.

If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus fanout parameter in the HAMT directory nodes. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00908 · 59.5th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2023-02-09T20:46Z
EPSS history
Timeline
  • 09 FEB 20:46Z
    HAMT Decoding Panics in github.com/ipfs/go-unixfsnode
    cvelistv5