Listen to this Post
How the mentioned CVE works
The vulnerability exists in the `thread_amount` function of the affected crate. On Windows, the function calls `CreateToolhelp32Snapshot` to obtain a snapshot handle for enumerating threads. However, it fails to call `CloseHandle` on the returned handle, leading to a persistent handle leak. Each invocation of the function permanently leaks one handle. On Apple platforms (macOS/iOS), the function calls task_threads, which allocates a buffer containing the thread list. The function neglects to deallocate this memory using vm_deallocate, resulting in a pure memory leak. Repeated calls, common in monitoring applications, cause a steady accumulation of unreleased handles or memory. This resource exhaustion eventually triggers system instability, process termination on Windows, or forcible killing by the Out-of-Memory (OOM) killer on Apple systems, leading to a crash.
Platform: Rust Crate
Version: Affected Versions
Vulnerability : Resource Leak
Severity: Critical
date: 2024-XX-XX
Prediction: Patch expected 2024-XX-XX
What Undercode Say:
`handle = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);`
`// … Thread enumeration logic …`
`// Missing: CloseHandle(handle);`
`kern_return_t kr = task_threads(mach_task_self(), &thread_list, &thread_count);`
`// … Process thread list …`
`// Missing: vm_deallocate(mach_task_self(), (vm_address_t)thread_list, thread_count sizeof(thread_act_t));`
How Exploit:
An attacker cannot directly control this flaw for code execution. However, by triggering the vulnerable function repeatedly, perhaps by causing high thread churn or through normal application polling, they can induce a denial-of-service condition. The application will eventually exhaust its resource limits and crash.
Protection from this CVE
Update the crate. For temporary mitigation, stop using the vulnerable `thread_amount` function. Implement external process monitoring to restart crashed applications.
Impact:
Denial-of-Service (DoS) through resource exhaustion, leading to application crash and system instability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
