2015-03-02-2-all-cpu-amplification.md (2677B)
1 Problem 2 ======= 3 4 CPU usage amplification attack. 5 6 Discovered by 7 ============= 8 9 Ben Laurie <ben@links.org> using [American Fuzzy Lop](http://lcamtuf.coredump.cx/afl/) 10 11 Announced 12 ========= 13 14 2015-03-02 15 16 CVE 17 === 18 19 CVE-2015-2312 20 21 Impact 22 ====== 23 24 - Remotely cause a peer to use excessive CPU time and other resources to 25 process a very small message, possibly enabling a DoS attack. 26 27 Fixed in 28 ======== 29 30 - git commit [104870608fde3c698483fdef6b97f093fc15685d][0] 31 - release 0.5.1.1: 32 - Unix: https://capnproto.org/capnproto-c++-0.5.1.1.tar.gz 33 - Windows: https://capnproto.org/capnproto-c++-win32-0.5.1.1.zip 34 - release 0.4.1.1: 35 - Unix: https://capnproto.org/capnproto-c++-0.4.1.1.tar.gz 36 - release 0.6 (future) 37 38 [0]: https://github.com/sandstorm-io/capnproto/commit/104870608fde3c698483fdef6b97f093fc15685d 39 40 Details 41 ======= 42 43 The Cap'n Proto list pointer format allows encoding a list whose elements are 44 claimed each to have a size of zero. Such a list could claim to have up to 45 2^29-1 elements while only taking 8 or 16 bytes on the wire. The receiving 46 application may expect, say, a list of structs. A zero-size struct is a 47 perfectly legal (and, in fact, canonical) encoding for a struct whose fields 48 are all set to their default values. Therefore, the application may notice 49 nothing wrong and proceed to iterate through and handle each element in the 50 list, potentially taking a lot of time and resources to do so. 51 52 Note that this kind of vulnerability is very common in other systems. Any 53 system which accepts compressed input can allow an attacker to deliver an 54 arbitrarily large uncompressed message using very little compressed bandwidth. 55 Applications should do their own validation to ensure that lists and blobs 56 inside a message have reasonable size. However, Cap'n Proto takes the 57 philosophy that any security mistake that is likely to be common in 58 naively-written application code is in fact a bug in Cap'n Proto -- we should 59 provide defenses so that the application developer doesn't have to. 60 61 To fix the problem, this change institutes the policy that, for the purpose of 62 the "message traversal limit", a list of zero-sized elements will be counted as 63 if each element were instead one word wide. The message traversal limit is an 64 existing anti-amplification measure implemented by Cap'n Proto; see: 65 66 https://capnproto.org/encoding.html#amplification-attack 67 68 Preventative measures 69 ===================== 70 71 This problem was discovered through fuzz testing using American Fuzzy Lop, 72 which identified the problem as a "hang", although in fact the test case just 73 took a very long time to complete. We are incorporating testing with AFL into 74 our release process going forward.