Vulnerability · Published May 10, 2023 · Assigned by GitHub_M
CVE-2023-25568Boxo bitswap/server: DOS unbounded persistent memory leak
High 8.2
In plain English
A high-severity uncontrolled resource consumption in boxo from ipfs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able allocate arbitrary many bytes in the Bitswap server, those allocations are lasting even if the connection is closed. This affects users accepting untrusted connections with the Bitswap server and also affects users using the old API stubs at `github.com/ipfs/go-libipfs/bitswap` because users then transitively import `github.com/ipfs/go-libipfs/bitswap/server`. Boxo versions 0.6.0 and 0.4.1 contain a patch for this issue. As a workaround, those who are using the stub object at `github.com/ipfs/go-libipfs/bitswap` not taking advantage of the features provided by the server can refactor their code to use the new split API that will allow them to run in a client only mode: `github.com/ipfs/go-libipfs/bitswap/client`.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/ipfs/go-bitswap | 0.12.0 | GHSA-q3j6-22wf-3jh9 |
| Go | github.com/ipfs/go-bitswap | 0.12.0 | GO-2023-1766 |
| Go | github.com/ipfs/go-libipfs | 0.6.0 | GHSA-m974-xj4j-7qv5 |
| Go | github.com/ipfs/go-libipfs | 0.4.1 | GHSA-m974-xj4j-7qv5 |
| Go | github.com/ipfs/go-libipfs | 0.4.1, 0.6.0 | GO-2023-1766 |
Affected products (as reported)
Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
References
- https://github.com/ipfs/boxo/commit/62cbac40b96f49e39cd7fedc77ee6b56adce4916
- https://github.com/ipfs/boxo/commit/9cb5cb54d40b57084d1221ba83b9e6bb3fcc3197
- https://github.com/ipfs/boxo/commit/baa748b682fabb21a4c1f7628a8af348d4645974
- https://github.com/ipfs/go-libipfs/security/advisories/GHSA-m974-xj4j-7qv5