CVE-2023-27483: Out-of-memory panic in github.com/crossplane/crossplane-runtime

Background

The github.com/crossplane/crossplane-runtime package is a Go library that provides runtime support for Crossplane, an open-source Kubernetes add-on that enables users to manage and provision cloud resources. The package includes the Paved type, which allows users to set values on objects according to a provided path. This functionality is used by applications that utilize the crossplane-runtime library to manipulate data structures.

Vulnerability Detail

An out-of-memory panic vulnerability has been discovered in the crossplane-runtime library. When using the Paved type's SetValue method with user-provided input that is not properly validated, excessive amounts of memory can be consumed, potentially leading to an out-of-memory panic. The vulnerability arises from the lack of validation in the Paved.SetValue method, which allows setting values in slices at any provided index, causing the target array to grow up to the requested index. If callers fail to validate path indexes, this can result in arbitrary memory consumption. Applications that do not use the Paved type's SetValue method are not affected.

go get github.com/crossplane/crossplane-runtime@v1.20.12

Workaround

If upgrading to a fixed version is not immediately feasible, users can implement a workaround by parsing and validating the path before passing it to the SetValue method of the Paved type. This involves constraining the index size to an appropriate limit to prevent excessive memory consumption. Here is an example of how to implement this workaround:

import (
	"github.com/crossplane/crossplane-runtime/pkg/fieldpath"
)

func SetValueSafely(paved *fieldpath.Paved, path string, value interface{}) error {
	// Parse and validate the path
	// ... (implementation details)

	// Set the value on the Paved object
	err := paved.SetValue(parsedPath, value)
	if err != nil {
		return err
	}

	return nil
}

Conclusion

The out-of-memory panic vulnerability in the crossplane-runtime library can be mitigated by upgrading to a fixed version or implementing the provided workaround. It is recommended to upgrade to versions 0.16.1, 0.19.2, or later to ensure the proper validation of user-provided input. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for github.com/crossplane/crossplane-runtime →

FAQ