Memory Explosion Bug
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
### Description
- We are analyzing malware samples for our research.
- We found that running capa with a malware sample (sha256: c177e0a9e745a247a944f805189daf4c2f3f059340290c8c0ec0861bacaa8316) leads to memory explosion: capa keeps consuming the memory till all the available memory gets exhausted, which kills the machine.
- The consequence of this bug could be severe for users running capa directly on their host, hence this report.
### Steps to Reproduce
1. Download and extract capa of version v.6.1.0 executable from https://github.com/mandiant/capa/releases/download/v6.1.0/capa-v6.1.0-linux.zip
2. Run capa with c177e0a9e745a247a944f805189daf4c2f3f059340290c8c0ec0861bacaa8316 malware sample.
3. Watch the memory consumption of capa.
- **Note: The binary that causes the bug is not publicly shared here because it is malware. The malware can be obtained from VirusTotal or I can share it with maintainers upon request.**
**Expected behavior:**
capa generates a behavior report.
**Actual behavior:**
capa hangs and keeps consuming the memory and exhausting all the memory on the host.
### Versions
v6.1.0, v5.1.0
(We have tested Linux version only)
### Additional Information
While the above steps are sufficient to reproduce the bug per se, we will try to collect information such as stack trace to help locate the root cause later.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the capa v6.1.0 executable and the documented command using sample hash c177e0a9e745a247a944f805189daf4c2f3f059340290c8c0ec0861bacaa8316. Obtain the malware sample from VirusTotal or the reporter, reproduce the memory growth on Linux, and collect the missing diagnostic information such as a stack trace. Done means identifying the cause and preventing capa from exhausting host memory while still producing a behavior report.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100