Nine-year-old bug in the Go standard library enables DoS

https://github.com/ethereum/public-attacknets/issues/12

by latchkey • 6 years ago

167 30 6 years ago

bawolff• 6 years ago

9 years may seem like a long time, but its also just a DoS vuln. Which is a real security issue in many contexts, but its not exactly a high severity one

antoncohen• 6 years ago

It wasn't a 9 year old reported bug that took 9 years to fix. It was a 9 year old undetected bug that took... I'm not sure, it looks like a 1 week from discovery by the Ethereum team to a fixed released by the Go team.

DougBTX2• 6 years ago

Interesting that you and another commenter interpreted "9 year old bug" to mean "bug discovered 9 years ago". I'd have thought it was unambiguous that the bug was introduced 9 years ago, but apparently it isn't!

From the article, "this attack was due to a 9 year old bug in the Go standard library. During the "post-mortem" @protolambda, @prestonvanloon, @raulk and I uncovered this bug," so at least they are quite clear that it is a recently discovered bug.

jerf2• 6 years ago

The issue:

"Certain invalid inputs to ReadUvarint or ReadVarint could cause those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. This could lead to processing more input than expected when the caller is reading directly from a network and depends on ReadUvarint and ReadVarint only consuming a small, bounded number of bytes, even from invalid inputs.

"With the update, ReadUvarint and ReadVarint now always return after consuming a bounded number of bytes (specifically, MaxVarintLen64, which is 10). The result being returned has not changed; the functions merely detect and return some errors without reading as much input."

What's a varint? This: https://developers.google.com/protocol-buffers/docs/encoding

You have to use varints to be affected, but of course you could be using them in a library without knowing it.

baby3• 6 years ago

So is it Golang’s varint or protobuf/grpc varint that had the bug? It’s not clear to me.

Edit: https://go-review.googlesource.com/c/go/+/247120/

jeffbee• 6 years ago

Proto has a different structure with a fully unrolled loop. It could never read more than 10 bytes. encoding/binary just looped as long as the more bit was set, which is a hazard of more-bit encodings (which suck; unary-length-prefixed codes like UTF-8 are strictly better in every way).

Kobajachi34222• 6 years ago

Misleading title. Reads like the bug was discovered 9 years ago but was not fixed until recently. However, the bug seems to have been fixed pretty fast. Thanks to the Go team!

vlovich123• 6 years ago

Another way to read it is that 9 years worth of software could be susceptible. It’s patched now but how long will it take that all executables have been updated? How long for all projects to update their dependencies to one with a fix? Generally software deployment also varies wildly in terms of quality and speed.

remexre• 6 years ago

And, since people tend to link Go statically, it's not just like `apt-get upgrade libgo`, one has to do a full recompile. (Which, to be fair, Go makes a lot less painful than many languages.)

shoo• 6 years ago

bugs objectively exist regardless of if they are discovered or not

jacobush• 6 years ago

For it to be a bug, it must have a context where it matters, but basically, yes :)

steve1820• 6 years ago

Quite an interesting read!

donatj• 6 years ago

Reading an oversized int from the network just keeps reading bytes unbounded eh? Do you have to provide an insanely long int or could it be combined with a slow loris?

Scaevolus• 6 years ago

It's basically slowloris-- send 0xFF every 20 seconds to keep the varint reader blocking waiting for the end of the number.

jeffrallen• 6 years ago

Aiee, code is hard. Great work to all involved. Glad the good guys found this one first.

Nine-year-old bug in the Go standard library enables DoS

Related Stories