Uncontrolled Resource Consumption in Ash Framework

Executive Summary

This vulnerability is an uncontrolled resource consumption issue in the Ash framework where a slow asynchronous read operation causes the system to busy-spin at full CPU usage. The function Ash.Actions.Read.AsyncLimiter.await_at_least_one/1 uses a tight loop with Task.yield(task, 0) to poll for task completion instead of blocking, consuming a scheduler thread entirely until the slow read finishes.

Useful 0 Not Useful 0

Detection Guidance

Monitor for high CPU usage on BEAM scheduler threads during slow async read operations. Check for processes stuck in tight loops by examining Task.yield calls in Ash framework versions 2.19.0 to 3.32.1. Use system monitoring tools like top, htop, or BEAM-specific tools like recon_alloc or observer_cli to detect abnormal CPU consumption patterns.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to CPU exhaustion and denial of service. A few concurrent slow requests may tie up all available schedulers, starving the system and potentially crashing the node. It affects applications exposing Ash reads over HTTP, even without authentication, if an attacker can influence query cost.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Ash framework to version 3.32.2 or later to apply the fix. If upgrading is not immediately possible, restrict access to endpoints that trigger slow async reads or implement rate limiting to prevent CPU exhaustion. Monitor system performance closely during peak usage periods.

Useful 0 Not Useful 0