gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header underflows the unsigned 32-bit value and drives an unbounded allocation of roughly 4 GiB, and two such messages in succession OOM-kill a collector, causing an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Gopacket Gopacket
cpe:2.3:a:gopacket:gopacket:*:*:*:*:*:go:*:*
|
— |
1.6.1
|
References 3
https://github.com/gopacket/gopacket/commit/145859d0eaee1a6f5925ffb93851c976449…
security-advisories@github.com
https://github.com/gopacket/gopacket/releases/tag/v1.6.1
security-advisories@github.com
https://github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5
security-advisories@github.com