google / google/gnxi

Security: Unbounded memory allocation in gNOI OS Install RPC (Resource Exhaustion)

Open
#405 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
289
Forks
131
Avg merge
1d 28m
Merged PRs (30d)
1

Description

### Description

A vulnerability in the `ReceiveOS` function within `gnoi/os/server.go` allows for uncontrolled memory consumption. The server fails to enforce a maximum size limit on the `bytes.Buffer` when receiving `TransferContent` messages.
### Impact

An authenticated remote attacker can stream an unlimited amount of data, causing the server to allocate memory until it triggers an Out of Memory (OOM) event, resulting in a Denial of Service (DoS). This has been validated by the Google VRP team (Issue #513177194).
### Steps to Reproduce

1. Authenticate to the gNOI endpoint.
2. Initiate an `Install` RPC.
3. Send continuous `TransferContent` chunks without sending a `TransferEnd`.
4. Observe memory usage increasing until process termination.

### Proposed Fix
I have submitted a Pull Request (#404) to address this by implementing a size cap on the buffer.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.