Memory Exhaustion in Gitoxide gix-pack

Executive Summary

This vulnerability is a Denial of Service (DoS) flaw in Gitoxide's gix-pack library before version 0.75.0. It allows remote attackers to crash the process by sending a malicious pack header with an excessively large object count (0xFFFFFFFF). This forces the system to attempt reserving hundreds of gigabytes of memory during clone or fetch operations, leading to resource exhaustion and termination.

Useful 0 Not Useful 0

Detection Guidance

Monitor for failed clone or fetch operations with error messages indicating memory allocation failures or OOM conditions. Check logs for processes aborting during pack header parsing. Use network traffic analysis to detect unusually large pack headers (12-byte headers with 0xFFFFFFFF object counts).

• Inspect system logs for crashes during git operations: grep -i 'out of memory\|alloc error\|oom' /var/log/syslog
• Monitor network traffic for malformed pack headers: tcpdump -i any -A -s 0 'tcp port 9418 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

Useful 0 Not Useful 0

Impact Analysis

If you use Gitoxide's gix-pack library in versions before 0.75.0, an attacker could disrupt your Git operations by sending a specially crafted pack header. This could cause clone or fetch operations to fail, leading to service interruptions or downtime for your version control system.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade gix-pack to version 0.75.0 or later immediately. If upgrading is not possible, restrict network access to git repositories or implement deep packet inspection to block malicious pack headers. Monitor for ongoing attacks and terminate suspicious connections.

• Update gix-pack: cargo update -p gix-pack --precise 0.75.0
• Apply network-level mitigations: Use firewalls to block unexpected git traffic or implement rate limiting on git operations.

Useful 0 Not Useful 0