GHSA-mj35-2rgf-cv8p

Source
https://github.com/advisories/GHSA-mj35-2rgf-cv8p
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-mj35-2rgf-cv8p/GHSA-mj35-2rgf-cv8p.json
Aliases
Published
2024-04-03T16:46:30Z
Modified
2024-04-05T01:28:39.837161Z
Details

Impact

DOS by Atom exhaustion is possible by calling oidcc_provider_configuration_worker:get_provider_configuration/1 or oidcc_provider_configuration_worker:get_jwks/1.

Since the name is usually provided as a static value in the application using oidcc, this is unlikely to be exploited.

Details

Example to illustrate the vulnerability.

{ok, Claims} =
  oidcc:retrieve_userinfo(
    Token,
    myapp_oidcc_config_provider,
    <<"client_id">>,
    <<"client_secret">>,
    #{}
  )

The vulnerability is present in oidcc_provider_configuration_worker:get_ets_table_name/1. The function get_ets_table_name is calling erlang:list_to_atom/1.

https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidccproviderconfiguration_worker.erl#L385-L388

There might be a case (Very highly improbable) where the 2nd argument of oidcc_provider_configuration_worker:get_*/1 is called with a different atom each time which eventually leads to the atom table filling up and the node crashing.

Patches

Patched in 3.0.2, 3.1.2 & 3.2.0-beta.3

Workarounds

Make sure only valid provider configuration worker names are passed to the functions.

References

  • https://erlef.github.io/security-wg/securecodinganddeploymenthardening/atom_exhaustion.html
References

Affected packages

Hex / oidcc

Package

Name
oidcc

Affected ranges

Type
SEMVER
Events
Introduced
3.0.0
Fixed
3.0.2

Hex / oidcc

Package

Name
oidcc

Affected ranges

Type
SEMVER
Events
Introduced
3.1.0
Fixed
3.1.2

Hex / oidcc

Package

Name
oidcc

Affected ranges

Type
SEMVER
Events
Introduced
3.2.0-beta.1
Fixed
3.2.0-beta.3