Heap Overflow in MessagePack for C#

Executive Summary

This vulnerability exists in MessagePack for C#, specifically in versions prior to 2.5.301 and 3.1.7. The issue is in the UnsafeBlitFormatterBase<T>.Deserialize method, which reads a byteLength value controlled by an attacker from an extension payload. It then allocates an array based on this byteLength without properly validating it against the extension header length or the remaining payload bytes.

Although the outer extension header is bounded by the available input, this bound is not used to constrain the inner byteLength before allocation. As a result, an attacker can send a very small payload that requests a very large array allocation, potentially causing resource exhaustion or other issues.

This vulnerability has been fixed in versions 2.5.301 and 3.1.7.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to control the size of an array allocation during deserialization, which can lead to excessive memory allocation.

This can cause denial of service (DoS) conditions by exhausting system memory or causing application crashes.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update MessagePack for C# to version 2.5.301 or later, or 3.1.7 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs during deserialization in the UnsafeBlitFormatterBase<T>.Deserialize method when an attacker-controlled byteLength is used to allocate an array without proper validation. Detection involves monitoring for unusually large memory allocations or crashes related to deserialization of MessagePack data, especially when using Unity blit resolvers.

Since the vulnerability is triggered by deserializing untrusted networked values such as vectors, matrices, or primitive arrays, you can detect attempts by inspecting network traffic for MessagePack extension payloads with suspiciously small payloads that request large allocations.

There are no specific commands provided in the available resources to detect this vulnerability directly. However, general approaches include:

• Monitoring application logs for out-of-memory exceptions or crashes related to MessagePack deserialization.
• Using network traffic analysis tools (e.g., Wireshark) to capture and inspect MessagePack payloads for abnormal extension payload sizes.
• Implementing custom logging or instrumentation in the deserialization code to log byteLength values before allocation.

Until patched, avoid using Unity blit resolvers on untrusted data or implement size limits before deserialization to mitigate exploitation.

Useful 0 Not Useful 0