Memory Exhaustion in Moby Sys User Package

Executive Summary

This vulnerability affects the github.com/moby/sys/user package in Go, which handles Unix-style user and group database files. Versions before 0.4.1 fail to properly limit entries when parsing /etc/passwd or /etc/group files. An attacker could exploit this by providing a specially crafted file to cause excessive memory consumption, potentially crashing the affected process due to an out-of-memory condition.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses the affected github.com/moby/sys/user package versions before 0.4.1. Inspect Go module dependencies or binaries for the package version. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

If you use the affected package in your Go application, an attacker with access to supply malicious user or group database files could trigger high memory usage, leading to process crashes. This could disrupt services relying on the package for user/group data parsing.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts availability by causing excessive memory consumption and potential process termination due to OOM conditions when parsing untrusted user or group database files. It does not directly affect confidentiality or integrity of data, which are key concerns for GDPR and HIPAA compliance. However, prolonged unavailability of systems processing such files could indirectly impact compliance by disrupting operations that handle personal or health data.

Useful 0 Not Useful 0

Mitigation Strategies

Update the github.com/moby/sys/user package to version 0.4.1 or later. Avoid parsing attacker-controlled user or group database files. Validate and limit untrusted input before parsing.

Useful 0 Not Useful 0