CVE-2023-5236

Overview

Infinispan ProtoStream is a Java serialization library based on the Protocol Buffers (Protobuf) data format. Applications describe their data with Protobuf schemas and marshallers, which ProtoStream's annotation processor can generate at compile time from annotated Java classes. ProtoStream is part of the Infinispan data grid platform, which uses it to encode cache data as Protobuf. It is published to Maven Central under org.infinispan.protostream: protostream is the core library, protostream-types provides marshallers for common Java types, and protostream-processor is the annotation processor.

A denial of service vulnerability (CVE-2023-5236) has been identified in Infinispan ProtoStream's generated marshallers, which allows authenticated attackers with sufficient permissions to store an object with circular references in an Infinispan cache and exhaust the server's resources when that object is marshalled, making the service unavailable.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects all versions of Infinispan ProtoStream prior to 4.6.2.Final.

Details

Module Info

• Product: Infinispan ProtoStream
• Affected packages: org.infinispan.protostream:protostream
• Affected versions: <4.6.2.Final
• GitHub repository: https://github.com/infinispan/protostream
• Published packages: https://central.sonatype.com/artifact/org.infinispan.protostream/protostream
• Package manager: Maven
• Fixed in:
  • OSS Infinispan ProtoStream 4.6.2.Final
  • NES for Infinispan ProtoStream v4.4.6

Vulnerability Info

This Medium-severity vulnerability is found in the org.infinispan.protostream:protostream package in all versions of Infinispan ProtoStream prior to 4.6.2.Final.

Marshallers generated by the ProtoStream annotation processor write each message-typed @ProtoField through GeneratedMarshallerBase.writeNestedMessage. That method opens a nested TagWriterImpl and recursively invokes the field's marshaller, but it never tracks or limits how deeply messages are nested:

protected final <T> void writeNestedMessage(BaseMarshallerDelegate<T> marshallerDelegate, ProtobufTagMarshaller.WriteContext ctx, int fieldNumber, T message) throws IOException {
   ByteArrayOutputStreamEx baos = new ByteArrayOutputStreamEx();
   TagWriterImpl nested = TagWriterImpl.newNestedInstance(ctx, baos);
   writeMessage(marshallerDelegate, nested, message);
   ctx.getWriter().writeBytes(fieldNumber, baos.getByteBuffer());
}

ProtoStream also does not detect circular object references. When an object graph whose message fields refer back to an earlier object (for example, a team that lists a player whose team field points back to that team) is marshalled, writeNestedMessage recurses through the cycle without end, allocating a new buffer and writer at every level until the thread's stack is exhausted and the JVM throws a StackOverflowError. In Infinispan, which encodes cache entries with ProtoStream, an authenticated user with permission to write to a cache can use such an object to cause a denial of service. The failure happens in the process that marshals the object graph: a serialized Protobuf message cannot carry a circular reference, so the cycle has to be present in the Java objects being written.

The CVE record describes this flaw as occurring during unmarshalling and causing out of memory errors. Red Hat's original bug report and the upstream fix (IPROTO-263) both place it in marshalling, where the recursion exhausts the thread stack, as described above.

Mitigation

Only recent versions of Infinispan ProtoStream are supported for vulnerability updates. Older versions are End-of-Life and will not receive updates addressing this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Infinispan ProtoStream that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.