CVE-2023-37475 : What You Need to Know

A denial of service vulnerability in Hamba Avro due to an attacker-controlled parameter can have a significant impact on affected systems.

Understanding CVE-2023-37475

This vulnerability in Hamba Avro can lead to uncontrolled consumption of resources, resulting in a denial of service.

What is CVE-2023-37475?

Hamba Avro, a Go lang encoder/decoder implementation of the Avro codec specification, is susceptible to a denial of service attack when a specific string is passed to Avro's

github.com/hamba/avro/v2.Unmarshal()

function.

The Impact of CVE-2023-37475

The attacker can cause a

fatal error: runtime: out of memory

by exploiting the vulnerability, leading to a denial of service for Avro consumers. This vulnerability poses a high availability impact.

Technical Details of CVE-2023-37475

In affected versions of Hamba Avro (< 2.13.0), an attacker can trigger a fatal error by manipulating a string input to the

Unmarshal()

function, causing an unrecoverable out-of-memory condition.

Vulnerability Description

The vulnerability arises due to Avro using part of the input to

Unmarshal()

for size determination during slice creation, enabling the attacker to consume excessive memory that may crash the application.

Affected Systems and Versions

Vendor: hamba
Product: avro
Affected Versions: < 2.13.0

Exploitation Mechanism

Attackers can exploit this vulnerability by providing a crafted string as input to the

Unmarshal()

function, triggering the out-of-memory condition.

Mitigation and Prevention

To mitigate CVE-2023-37475 and prevent denial of service attacks, immediate steps and long-term security practices are recommended.

Immediate Steps to Take

Users are advised to upgrade to release version 2.13.0 that includes the fix in commit

b4a402f4

. No known workarounds are available for this vulnerability at the moment.

Long-Term Security Practices

Maintain a regular patching schedule and stay updated on security advisories for the Hamba Avro library to prevent potential vulnerabilities.