oss-security - docker2aci: infinite loop in deps walking(CVE-2016-8579)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <5EDB84F4B23F5B4DB6500A89258280E03251E6E6@EX02.corp.qihoo.net>
Date: Fri, 14 Oct 2016 02:53:13 +0000
From: 张开翔 <zhangkaixiang@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: docker2aci: infinite loop in deps walking(CVE-2016-8579)

Hello,

It was found that docker2aci fall into an infinite loop while traversing the dependency ancestry of a malformed image file.
,this flaw may cause excessive CPU cycles & resources consume on the host. The happens because no essential check for duplicated
image ID found in  getAncestry() in docker2aci,

CVE-2016-8579 was assigned to this flaw by cve-assign@...re.org<mailto:cve-assign@...re.org>. Here the reply from CVE Assignment Team:

docker2aci is apparently a library [...] and we almost always recognize

the potential for an unattended use case for any library.

[...]

Someone can call the ConvertSavedFile function from an arbitrary

application. [...] It might be automated with cron or a similar unattended

tool that runs in an unrestricted (non-container) environment. Thus,

there is an availability impact because no human is around to notice

the CPU usage.

Use CVE-2016-8579.

References:

https://github.com/appc/docker2aci/issues/203(issue)

https://github.com/lucab/docker2aci/commit/54331ec7020e102935c31096f336d31f6400064f(patch)

Please, use it in the public communications regarding this flaw.

Best regards,

Kaixiang Zhang of Gear Team, Qihoo 360

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.