CVE-2023-25568 : Security Advisory and Response

This CVE, published on May 10, 2023, pertains to a vulnerability in Boxo bitswap/server that leads to a Denial of Service (DOS) unbounded persistent memory leak.

Understanding CVE-2023-25568

In this section, we will delve into the details of CVE-2023-25568 and understand its implications.

What is CVE-2023-25568?

The vulnerability affects Boxo, previously known as go-libipfs, which is a library used for building IPFS applications and implementations. Specifically, versions 0.4.0 and 0.5.0 of Boxo are susceptible to the issue. Attackers can exploit this vulnerability by allocating an excessive number of bytes in the Bitswap server, leading to persistent memory leaks even after the connection is terminated.

The Impact of CVE-2023-25568

Users who accept untrusted connections with the Bitswap server or those utilizing the old API stubs at

github.com/ipfs/go-libipfs/bitswap/server

are affected by this vulnerability. The continuous allocation of memory can result in resource exhaustion and potential Denial of Service attacks.

Technical Details of CVE-2023-25568

This section will provide a deeper insight into the technical aspects of CVE-2023-25568.

Vulnerability Description

The vulnerability in Boxo versions 0.4.0 and 0.5.0 allows attackers to cause a persistent memory leak by allocating arbitrary amounts of memory in the Bitswap server, leading to resource exhaustion and DOS conditions.

Affected Systems and Versions

The impacted systems include users running Boxo versions 0.4.0 and 0.5.0. Those who accept untrusted connections with the Bitswap server or use the old API stubs are particularly at risk.

Exploitation Mechanism

By manipulating memory allocation in the Bitswap server, attackers can trigger unbounded memory usage, causing persistent memory leaks and potentially leading to a DOS scenario.

Mitigation and Prevention

Taking immediate steps to address CVE-2023-25568 is crucial to safeguard systems and prevent potential exploitation.

Immediate Steps to Take

Users are advised to update Boxo to versions 0.6.0 or 0.4.1, which contain patches for the vulnerability. Additionally, those utilizing the old API stub at

github.com/ipfs/go-libipfs/bitswap

can refactor their code to use the new split API for enhanced security.

Long-Term Security Practices

Implementing secure coding practices, such as input validation and proper resource management, can help mitigate similar vulnerabilities in the future. Regular security audits and code reviews are also recommended.

Patching and Updates

Regularly monitoring for security updates and applying patches promptly is essential to protect systems from known vulnerabilities. Stay informed about security advisories and follow best practices to ensure the overall security of your applications and systems.