MessagePack-CSharp LZ4 Deserialization Buffer Overflow

Executive Summary

This vulnerability exists in MessagePack for C#, a serializer for C#. Before versions 2.5.301 and 3.1.7, when decompressing Lz4Block or Lz4BlockArray payloads, the software reads the declared uncompressed length from the data stream and allocates memory buffers based on that length without first validating the compressed data or checking if the declared size is reasonable.

An attacker can exploit this by sending a small compressed payload that falsely claims a very large uncompressed size, causing the program to allocate a large amount of memory unnecessarily before decompression begins.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to excessive memory allocation, which may cause denial of service (DoS) conditions by exhausting system memory resources.

This can degrade system performance or cause the application to crash, potentially disrupting services that rely on MessagePack for C#.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update MessagePack for C# to version 2.5.301 or later, or 3.1.7 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability by causing excessive memory allocation and potential process termination when decompressing untrusted MessagePack payloads. It does not directly involve unauthorized access, data disclosure, or modification.

Since the issue relates to resource exhaustion and denial of service rather than data confidentiality or integrity, its effect on compliance with standards like GDPR or HIPAA is indirect and limited to availability requirements.

Organizations relying on MessagePack-CSharp for deserialization should consider the risk of service disruption, which could impact availability controls mandated by such regulations, but there is no explicit mention of data breach or privacy violations in the provided information.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads with untrusted input that declares excessively large uncompressed lengths, leading to large memory allocations. Detection involves monitoring for unusually large memory allocations or out-of-memory exceptions during MessagePack deserialization.

Since the vulnerability is triggered by attacker-controlled MessagePack payloads using LZ4 compression, you can detect suspicious activity by inspecting network traffic for MessagePack payloads with Lz4Block or Lz4BlockArray compression and checking the declared uncompressed lengths.

There are no specific commands provided in the resources, but general approaches include:

• Using network packet capture tools (e.g., tcpdump, Wireshark) to capture and analyze MessagePack payloads for suspiciously large declared uncompressed lengths.
• Monitoring application logs and system metrics for out-of-memory errors or process crashes related to MessagePack deserialization.
• Implementing custom instrumentation or debugging in the application to log decompressed length values before allocation.

Until patched, a workaround is to avoid using MessagePack-CSharp's built-in LZ4 compression modes for untrusted inputs or enforce strict size limits externally before deserialization.

Useful 0 Not Useful 0