Headline
GHSA-5873-6fwq-463f: stellar-strkey vulnerable to panic in SignedPayload::from_payload
Impact
Panic vulnerability when a specially crafted payload is used. This is because of the following calculation:
inner_payload_len + (4 - inner_payload_len % 4) % 4
If inner_payload_len is 0xffffffff, (4 - inner_payload_len % 4) % 4 = 1 so
inner_payload_len + (4 - inner_payload_len % 4) % 4 = u32::MAX + 1
which overflow.
Patches
Check that inner_payload_len is not above 64 which should never be the case.
Patched in version 0.0.8
Workarounds
Sanitize input payload before it is passed to the vulnerable function so that bytes in payload[32..32+4] and parsed as a u32 is not above 64.
References
GitHub issue #58
Package
cargo stellar-strkey (Rust)
Affected versions
< 0.0.8
Patched versions
0.0.8
Description
Impact
Panic vulnerability when a specially crafted payload is used.
This is because of the following calculation:
inner_payload_len + (4 - inner_payload_len % 4) % 4
If inner_payload_len is 0xffffffff, (4 - inner_payload_len % 4) % 4 = 1 so
inner_payload_len + (4 - inner_payload_len % 4) % 4 = u32::MAX + 1
which overflow.
Patches
Check that inner_payload_len is not above 64 which should never be the case.
Patched in version 0.0.8
Workarounds
Sanitize input payload before it is passed to the vulnerable function so that bytes in payload[32…32+4] and parsed as a u32 is not above 64.
References
GitHub issue #58
References
- GHSA-5873-6fwq-463f
- stellar/rs-stellar-strkey#58
- stellar/rs-stellar-strkey#59
- stellar/rs-stellar-strkey@83adad0
- https://github.com/stellar/rs-stellar-strkey/releases/tag/v0.0.8
C0x41lch0x41 published to stellar/rs-stellar-strkey
Oct 24, 2023
Published to the GitHub Advisory Database
Oct 25, 2023
Reviewed
Oct 25, 2023
Related news
rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.`inner_payload_len` should not above 64. This vulnerability has been patched in version 0.0.8.