SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way

2021-09-0917:11:31

Google

osv.dev

0.007 Low

EPSS

Percentile

80.1%

JSON

Impact

The Snappy frame decoder function doesn’t restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well.

This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

Impact

All users of SnappyFrameDecoder are affected and so the application may be in risk for a DoS attach due excessive memory usage.

References

https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L79
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L171
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L185

CPENameOperatorVersion
io.netty:nettyeq3.5.0.Beta1
io.netty:netty-codeceq4.0.42.Final
io.netty:netty-codeceq4.0.37.Final
io.netty:netty-codeceq4.1.17.Final
io.netty:netty-codeceq4.1.0.Beta4
io.netty:netty-codeceq4.0.14.Final
org.jboss.netty:nettyeq3.2.0.ALPHA2
io.netty:nettyeq3.5.2.Final
io.netty:nettyeq3.6.3.Final
io.netty:netty-codeceq4.0.19.Final

Name	Operator	Version
io.netty:netty	eq	3.5.0.Beta1
io.netty:netty-codec	eq	4.0.42.Final
io.netty:netty-codec	eq	4.0.37.Final
io.netty:netty-codec	eq	4.1.17.Final
io.netty:netty-codec	eq	4.1.0.Beta4
io.netty:netty-codec	eq	4.0.14.Final
org.jboss.netty:netty	eq	3.2.0.ALPHA2
io.netty:netty	eq	3.5.2.Final
io.netty:netty	eq	3.6.3.Final
io.netty:netty-codec	eq	4.0.19.Final