[ https://issues.apache.org/jira/browse/KAFKA-14063?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17608137#comment-17608137 ]
Manikumar edited comment on KAFKA-14063 at 9/26/22 2:21 PM: ------------------------------------------------------------ commit for 2.8 branch: [https://github.com/apache/kafka/commit/14951a83e3fdead212156e5532359500d72f68bc] commit for 3.0 branch: [https://github.com/apache/kafka/commit/aaceb6b79bfcb1d32874ccdbc8f3138d1c1c00fb] commit for 3.1 branch: [https://github.com/apache/kafka/commit/c1295662768e64b4467e27c3d5158f95f2307657] commit for 3.2 branch: [https://github.com/apache/kafka/commit/2bfa24b2bd416e7b8c4a0c566b984c43904fdecb] was (Author: omkreddy): commit for 2.8 branch: [https://github.com/apache/kafka/commit/14951a83e3fdead212156e5532359500d72f68bc] commit for 3.0 branch: https://github.com/apache/kafka/commit/aaceb6b79bfcb1d32874ccdbc8f3138d1c1c00fb commit for 3.1 branch: https://github.com/apache/kafka/commit/c1295662768e64b4467e27c3d5158f95f2307657 commit for 3.2 branch: https://github.com/apache/kafka/commit/2bfa24b2bd416e7b8c4a0c566b984c43904fdecb > CVE-2022-34917: Kafka message parsing can cause ooms with small antagonistic > payloads > ------------------------------------------------------------------------------------- > > Key: KAFKA-14063 > URL: https://issues.apache.org/jira/browse/KAFKA-14063 > Project: Kafka > Issue Type: Bug > Components: generator > Affects Versions: 3.2.0 > Reporter: Daniel Collins > Priority: Major > Fix For: 2.8.2, 3.3.0, 3.0.2, 3.1.2, 3.2.3 > > > When parsing code receives a payload for a variable length field where the > length is specified in the code as some arbitrarily large number (assume > INT32_MAX for example) this will immediately try to allocate an ArrayList to > hold this many elements, before checking whether this is a reasonable array > size given the available data. > The fix for this is to instead throw a runtime exception if the length of a > variably sized container exceeds the amount of remaining data. Then, the > worst a user can do is force the server to allocate 8x the size of the actual > delivered data (if they claim there are N elements for a container of Objects > (i.e. not a byte string) and each Object bottoms out in an 8 byte pointer in > the ArrayList's backing array). > This was identified by fuzzing the kafka request parsing code. -- This message was sent by Atlassian Jira (v8.20.10#820010)