Memory Corruption in MessagePack for C#

Executive Summary

This vulnerability exists in MessagePack for C#, specifically in its multi-dimensional array formatters prior to versions 2.5.301 and 3.1.7. The formatter reads dimension lengths directly from the payload and allocates multi-dimensional arrays (such as T[,], T[,,], or T[,,,]) before verifying that the total number of elements matches the encoded element count. Because the allocation happens before validation, an attacker can craft a small payload that declares very large dimensions but provides only a tiny or empty inner array. This causes the program to allocate a large amount of heap memory unnecessarily, potentially leading to resource exhaustion.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to excessive memory allocation on the heap, which may cause a denial of service (DoS) condition by exhausting system memory resources. This can degrade system performance or cause the application to crash, impacting availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update MessagePack for C# to version 2.5.301 or 3.1.7 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability by causing excessive memory allocation, which can lead to out-of-memory exceptions and system crashes. It does not directly involve unauthorized access to or disclosure of personal or sensitive data.

Therefore, while it may affect the reliability and availability of systems processing untrusted MessagePack payloads, there is no explicit indication that it compromises compliance with data protection standards such as GDPR or HIPAA, which focus on confidentiality, integrity, and privacy of personal data.

However, if system availability is critical to compliance requirements, organizations should consider the risk of denial-of-service conditions caused by this vulnerability and apply patches or mitigations accordingly.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusual memory allocation patterns or out-of-memory exceptions in applications using MessagePack-CSharp to deserialize multi-dimensional arrays from untrusted payloads.

Specifically, detection involves identifying if the application is deserializing MessagePack payloads containing multi-dimensional arrays (T[,], T[,,], T[,,,]) where the dimension lengths declared in the payload do not match the actual element count, leading to excessive memory allocation.

Since the vulnerability is triggered by network-based payloads, network monitoring tools can be used to capture and analyze MessagePack payloads for suspicious dimension values.

Suggested commands or approaches include:

• Use application logs or monitoring tools to detect out-of-memory exceptions or crashes related to MessagePack deserialization.
• Capture network traffic on ports used by the vulnerable application and analyze MessagePack payloads for unusually large dimension values in multi-dimensional arrays.
• If you have access to the application source or runtime, add instrumentation or debugging to log the dimensions and element counts during deserialization in TwoDimensionalArrayFormatter<T>.Deserialize, ThreeDimensionalArrayFormatter<T>.Deserialize, and FourDimensionalArrayFormatter<T>.Deserialize.
• Use memory profiling tools to monitor heap allocations and CPU usage spikes that may indicate exploitation attempts.

Useful 0 Not Useful 0