Executive Summary

This vulnerability exists in the spdystream Go library versions 0.5.0 and below, which is used for multiplexing streams over SPDY connections. The issue arises because the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Specifically, three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes. These values are read as 32-bit integers and used directly for memory allocation without any bounds checking.

Since SPDY header blocks are compressed using zlib, a small payload on the wire can decompress into large attacker-controlled values. This allows a remote attacker who can send SPDY frames to a service using spdystream to cause the process to exhaust its memory and crash due to out-of-memory conditions with just a single crafted control frame.

This vulnerability has been fixed in version 0.5.1 of spdystream.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a denial-of-service (DoS) condition by exhausting the memory of the affected process. An attacker who can send SPDY frames to a vulnerable service can cause it to crash due to out-of-memory errors with a single crafted control frame.

Such crashes can disrupt service availability, potentially causing downtime and impacting users who rely on the affected service.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the spdystream library to version 0.5.1 or later, where the issue has been fixed.

Useful 0 Not Useful 0