gopacket vulnerabilities

gopacket, a Go packet processing library, prior to 1.7.2 passes attacker-controlled declared lengths and counts in layers/sctp.go to the SCTP sub-decoders (decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, decodeSCTPParameter) without checking that each chunk contains the required fields. A crafted SCTP segment can cause out-of-bounds or inverted slice panics. The panic can terminate applications using SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic; default recovery-enabled APIs convert it to a per-packet decode error.

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.

The gopacket library for Go version 1.6.0 and earlier has a vulnerability in the Diameter AVP decoder. An attacker can control the Length field in an AVP, causing an unsigned 32-bit underflow and allocation of about 4 GiB memory. Two such messages can cause OOM and denial of service.

The gopacket library for Go version 1.6.0 and earlier has a vulnerability in the sFlow ExtendedGatewayFlow decoder. An attacker controls 32-bit community and AS path member counts, leading to allocation of up to 16 GiB memory from a 104-byte UDP datagram, causing denial of service.