CVE-2022-26477: systemds - CPU Exhaustion Vulnerability
Summary
CVE-2022-26477: The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. Affects systemds versions < 2.2.2. Fixed in 2.2.2. How to fix ↓
Also tracked for
- org.apache.systemds:systemds · Maven
The same CVE-2022-26477 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SystemDS is a distributed system that requires serialization/deserialization of data. It is commonly used in code paths such as Spark broadcast/shuffle or writing to sequence files. However, in the readExternal method, the termination condition of the for loop is a controllable variable, which can be manipulated to cause CPU exhaustion. This vulnerability affects versions prior to 2.2.2.
Vulnerability Detail
The termination condition of the for loop in the readExternal method can be tampered with, leading to CPU exhaustion. An attacker would need to modify two entries in the byte stream consistently to exploit this vulnerability. The fix for this vulnerability includes adding an upper bound and termination condition in the read and write logic. These changes improve robustness with minimal overhead.
How To Fix
Minimum fixed version
2.2.2
This is the first release that contains the fix.
pip install --upgrade "systemds==2.2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no mentioned workarounds for this vulnerability.
Conclusion
The CPU exhaustion vulnerability in the systemds package has been addressed in version 2.2.2. It is recommended to upgrade to this version to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for systemds →
FAQ
This vulnerability can lead to CPU exhaustion, potentially causing denial of service.
An attacker would need to modify two entries in the byte stream consistently to exploit this vulnerability.
The fix for this vulnerability includes adding an upper bound and termination condition in the read and write logic.
Versions prior to 2.2.2 are affected by this vulnerability.
The performance impact after applying the fix is minimal.
