Rclone SquashFS Backend Integer Overflow and DoS Vulnerability Analysis

Vulnerability Overview Title: Malformed SquashFS Images Cause Process Crashes and Persistent CPU Loops in rclone's Archive Backend Description: Vulnerability Type: Malformed SquashFS images causing process crashes and persistent CPU loops Affected Component: rclone's archive backend Specific Manifestations: 1. Zero block size leads to integer division, triggering a panic. 2. Out-of-range metadata offsets cause unchecked slice panics. 3. Truncated metadata streams can repeatedly return successful zero-length blocks, causing non-progressing loops and sustained CPU consumption. CVSS Score: 6.5 / 10 Scope of Impact Affected Versions: - >= v1.7.2.0, <= v1.7.4.4 - Patched Version: 1.7.5.0 Affected Components: - - Attack Surface: - Standard rclone commands - - WebDAV/HTTP services - FTP service - RC jobs and mounts Remediation Required Fixes: - In : - Validate before any division, allocation, shift, or cache calculations. - Reuse existing block size validators or enforce values to be allowed SquashFS powers of two (from 4096 to 1048576). - Validate that is consistent with the accepted block size. - In : - Check and from the two-byte metadata header . EOF or short reads should return a format error. - Before , require and return a descriptive invalid image error. - Enforce a progress invariant in : every successful iteration must append bytes to satisfy the requested logical size. Do not continue after a zero-length decoded block. - Boundary-check metadata offsets and additions against the provided image length, including integer overflow checks. - Compare the uncompressed metadata output against the maximum SquashFS metadata block size. This is additional hardening, not a substitute for EOF and progress checks. Risk Classification: - CVSS 3.1 Score: 5.3 - Vector: POC Code Direct rclone Reproduction Observations: Observations: Observations: SFTP Process-Level Verification WebDAV Limitation and Loop Verification Impact Assessment Impact: Availability Variants 1 and 2: Reliably terminate one-off rclone processes Variant 3: Allows parsing operations to consume CPU indefinitely Remediation Guidance Required Fixes: - In : - Validate before any division, allocation, shift, or cache calculations. - Reuse existing block size validators or enforce values to be allowed SquashFS powers of two (from 4096 to 1048576). - Validate that is consistent with the accepted block size. - In : - Check and from the two-byte metadata header . EOF or short reads should return a format error. - Before , require and return a descriptive invalid image error. - Enforce a progress invariant in : every successful iteration must append bytes to satisfy the requested logical size. Do not continue after a zero-length decoded block. - Boundary-check metadata offsets and additions against the provided image length, including integer overflow checks. - Compare the uncompressed metadata output against the maximum SquashFS metadata block size. This is additional hardening, not a substitute for EOF and progress checks. Risk Classification: - CVSS 3.1 Score: 5.3 - Vector: Public Reference Check rclone archive SquashFS adapter go-diskfs v1.9.4 SquashFS initialization go-diskfs v1.9.4 metadata block parsing --- The above is a summary of key information regarding the vulnerability extracted from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

Rclone SquashFS Backend Integer Overflow and DoS Vulnerability Analysis

More from this source