NanaZip UFS Parser Unbounded Memory Allocation (DoS) Vulnerability (GHSA-m34h-jf84-m74h) and PoC

Vulnerability Overview Vulnerability Name: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields Description: The UFS/FFS image processor in NanaZip ( ) only checks the lower bound ( ) when validating superblock size, failing to validate the fragment size ( ). An attacker can craft a malicious block size, leading to multi-gigabyte memory allocations and resulting in a Denial of Service (DoS). Root Cause: In the function, the only sanity check for block size is the lower bound. (fs_bsize) can be any value from to (approximately 2 GiB), while is entirely unchecked. is subsequently passed unbounded into multiple allocations, such as the allocation of three indirect block buffers in . Scope of Impact Affected Versions: = 6.5.1749.0 CVSS Score: 2.4 / 10 Vulnerability Type: CWE-789 / CWE-400 (Uncontrolled Resource Consumption / Allocation of Resources Without Limits or Throttling) Trigger Conditions: By simply opening (loading) a crafted UFS image, no special user interaction is required; it suffices to open the archive file in a browser. Remediation In the function, in addition to the existing check, block sizes exceeding the maximum UFS limit ( ) should be rejected. Furthermore, should be validated to ensure it falls within its valid range ( , , ), matching the superblock validation performed by the kernel. Any allocations derived from these fields should be bounded against the actual stream length prior to allocation. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

NanaZip UFS Parser Unbounded Memory Allocation (DoS) Vulnerability (GHSA-m34h-jf84-m74h) and PoC

More from this source