mandiant / mandiant/capa

Memory Explosion Bug

Open
#1,836 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

performance viv-bug
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

### Description

- We are analyzing malware samples for our research.
- We found that running capa with a malware sample (sha256: c177e0a9e745a247a944f805189daf4c2f3f059340290c8c0ec0861bacaa8316) leads to memory explosion: capa keeps consuming the memory till all the available memory gets exhausted, which kills the machine.
- The consequence of this bug could be severe for users running capa directly on their host, hence this report.

### Steps to Reproduce

1. Download and extract capa of version v.6.1.0 executable from https://github.com/mandiant/capa/releases/download/v6.1.0/capa-v6.1.0-linux.zip

2. Run capa with c177e0a9e745a247a944f805189daf4c2f3f059340290c8c0ec0861bacaa8316 malware sample.
3. Watch the memory consumption of capa.
- **Note: The binary that causes the bug is not publicly shared here because it is malware. The malware can be obtained from VirusTotal or I can share it with maintainers upon request.**

**Expected behavior:**
capa generates a behavior report.

**Actual behavior:**
capa hangs and keeps consuming the memory and exhausting all the memory on the host.

### Versions
v6.1.0, v5.1.0
(We have tested Linux version only)

### Additional Information
While the above steps are sufficient to reproduce the bug per se, we will try to collect information such as stack trace to help locate the root cause later.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the capa v6.1.0 executable and the documented command using sample hash c177e0a9e745a247a944f805189daf4c2f3f059340290c8c0ec0861bacaa8316. Obtain the malware sample from VirusTotal or the reporter, reproduce the memory growth on Linux, and collect the missing diagnostic information such as a stack trace. Done means identifying the cause and preventing capa from exhausting host memory while still producing a behavior report.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.