MessagePack MessagePackReader.ReadDateTime Stack Overflow via Attacker-controlled Extension Length (CVE-2024-48502)

Vulnerability Overview Title: Attacker-controlled DateTime extension length causes stack overflow Description: The method can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the calculated includes the extension body length read from the wire and is validated as one of the valid timestamp sizes before the operation. A very small payload can declare a large timestamp extension body length, causing excessive stack allocation and triggering an uncatchable , which terminates the host process. Impact Scope Affected Components: - Package: MessagePack - API: MessagePackReader.ReadDateTime - Data Type: DateTime and formatted paths invoking ReadDateTime - Discovery ID: MESSAGEPACKSHARP-029, Related stack allocation discovery MESSAGEPACKSHARP-CRON-MER-001 Affected Versions: [3.0.3.1.7] Fixed Version: 3.1.7 Remediation Patch: - The fix is prepared and will be released in a coordinated patch version. - Upgrade Guide: 1. Upgrade MessagePack to the patched version. 2. Upgrade companion MessagePack packages in the same dependency graph to the coordinated patch version. - The fix should validate the timestamp extension length before performing any stack allocations. Valid MessagePack timestamp payload lengths are limited to supported timestamp encodings, and excessive extension lengths should throw a catchable MessagePack serialization exception before allocating buffers on the slow path. Workarounds: - Until the patch is available, avoid deserializing untrusted MessagePack payloads containing DateTime or DateTimeOffset values. - Enforce strict maximum message size limits whenever possible, and reject malformed extension lengths before they reach MessagePack-CSharp. - There is no complete workaround for applications that must deserialize attacker-controlled MessagePack data containing timestamp fields. References MESSAGEPACKSHARP-029: ReadDateTime stack allocation from attacker-controlled extension length MESSAGEPACKSHARP-CRON-MER-001: Related attacker-controlled stack allocation discovery in MessagePackReader CVE-770: Unbounded or Insufficiently Bounded Resource Allocation CVE Separation Rationale The vulnerability exists independently in the DateTime extension parsing path by validating the extension length before stack allocation. It is separate from recursive stack overflow, LZ4 issues, and collection allocation bugs. Additional Information Severity: High (8.2 / 10) CVSS v4 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Attack Requirements: Present - Privileges Required: User Interaction - Affected System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: High - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None CVE ID: CVE-2024-48502 Weakness: CWE-789 Credit: AAmott (Remediation Developer)

Goal Reached Thanks to every supporter — we hit 100%!

MessagePack MessagePackReader.ReadDateTime Stack Overflow via Attacker-controlled Extension Length (CVE-2024-48502)

More from this source