Impact Analysis

This vulnerability can cause the MinIO server to crash due to memory exhaustion when processing maliciously crafted CSV files without newline characters.

Such crashes can lead to denial of service (DoS), disrupting access to stored data and impacting availability.

Since exploitation requires authenticated user permissions (s3:PutObject and s3:GetObject), an attacker with these permissions can intentionally cause service interruptions.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects MinIO's S3 Select feature when processing CSV files that contain lines longer than the available memory. The CSV reader function nextSplit() uses bufio.Reader.ReadBytes('\n') without any size limit, which causes it to buffer the entire input in memory until a newline character is found.

If a CSV file has no newline characters, the entire file content is read into a single memory allocation, leading to an out-of-memory (OOM) crash of the MinIO server process.

An attacker who is an authenticated user with s3:PutObject and s3:GetObject permissions can exploit this by uploading specially crafted CSV files. The attack is more effective when the CSV file is compressed (e.g., gzip), as a small compressed file can decompress into gigabytes of data without newlines, causing large memory consumption on the server.

Useful 0 Not Useful 0