GHSA-c66h-hf5j-8jf9

Описание

Origin

This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.

Source references

deps/amqp10_common/src/amqp10_binary_parser.erl:148 · Unbounded Allocation DoS

Impact

An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service.

Description

parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each — with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process.

Exploit scenario

Attacker TCP-connects to port 5672, sends the AMQP 1.0 protocol header and SASL header, then a SASL-init frame whose initial-response field is encoded as array32 (0xF0) with declared Size=8, Count=0xFFFFFFFF, element constructor 0x45. Total payload ≈19 bytes. The reader allocates a 4.29-billion-element list (~100+ GB of cons cells); the node OOMs within seconds.

Preconditions

• Network reachability to the AMQP listener (port 5672, enabled by default)
• No authentication required

CVSS

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (8.2, High). Fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0.