Security: Unbounded memory allocation in gNOI OS Install RPC (Resource Exhaustion)
- Dominant language
- Python
- Stars
- 289
- Forks
- 131
- Avg merge
- 1d 28m
- Merged PRs (30d)
- 1
Description
### Description
A vulnerability in the `ReceiveOS` function within `gnoi/os/server.go` allows for uncontrolled memory consumption. The server fails to enforce a maximum size limit on the `bytes.Buffer` when receiving `TransferContent` messages.
### Impact
An authenticated remote attacker can stream an unlimited amount of data, causing the server to allocate memory until it triggers an Out of Memory (OOM) event, resulting in a Denial of Service (DoS). This has been validated by the Google VRP team (Issue #513177194).
### Steps to Reproduce
1. Authenticate to the gNOI endpoint.
2. Initiate an `Install` RPC.
3. Send continuous `TransferContent` chunks without sending a `TransferEnd`.
4. Observe memory usage increasing until process termination.
### Proposed Fix
I have submitted a Pull Request (#404) to address this by implementing a size cap on the buffer.
Contributor guide
Assessment
This issue has not been assessed yet.