Stack Exhaustion in libmodulemd via Deeply Nested XMD YAML

Executive Summary

This vulnerability is in libmodulemd, a library for parsing module metadata. When processing YAML data with deeply nested xmd fields, the library converts this into GVariant values without limits on recursion depth or node count. This can cause stack exhaustion or excessive resource use, leading to a denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or excessive resource usage when parsing modulemd YAML files. Use tools like modulemd-validator on suspicious files to check for stack exhaustion. Look for unusually deep xmd nesting in module metadata files.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this by providing maliciously crafted modulemd YAML with deeply nested xmd content. This could crash applications or consume excessive CPU and memory, disrupting services. Only systems processing untrusted modulemd data are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts availability by causing denial of service. It does not directly affect confidentiality or integrity, so compliance with standards like GDPR or HIPAA is indirectly impacted only if service disruption leads to downtime or data unavailability.

Useful 0 Not Useful 0

Mitigation Strategies

Avoid parsing untrusted modulemd documents with attacker-controlled xmd data. Implement strict parsing limits to reject deeply nested xmd structures. Isolate parsing in restricted environments until a fix is available.

Useful 0 Not Useful 0