When minidump parses a module list it takes the number of modules directly from the input file:
mml.NumberOfModules = int.from_bytes(buff.read(4), byteorder = 'little', signed = False)
And afterwards it loops over the unconstrained number of modules and fills a list with MINIDUMP_MODULE objects:
for _ in range(mml.NumberOfModules):
mml.Modules.append(MINIDUMP_MODULE.parse(buff))This makes applications using minidump susceptible to DOS since a malicious minidump file could cause allocations of
4294967295 MINIDUMP_MODULE objects taking up a lot of memory on the host.
Would it be possible to limit the number of module objects to prevent the DOS?
This pattern where minidump takes a number of items directly from the input stream and loops over that
number can be found in a lot of other places too. MINIDUMP_MODULE_LIST is not the only class with this weakness.
An example file that lets minidump consume a lot of memory is the following:
oom-0b4dee5bb1227364f2bfc342047532c1212b05ae
When minidump parses a module list it takes the number of modules directly from the input file:
And afterwards it loops over the unconstrained number of modules and fills a list with
MINIDUMP_MODULEobjects:This makes applications using minidump susceptible to DOS since a malicious minidump file could cause allocations of
4294967295
MINIDUMP_MODULEobjects taking up a lot of memory on the host.Would it be possible to limit the number of module objects to prevent the DOS?
This pattern where minidump takes a number of items directly from the input stream and loops over that
number can be found in a lot of other places too.
MINIDUMP_MODULE_LISTis not the only class with this weakness.An example file that lets minidump consume a lot of memory is the following:
oom-0b4dee5bb1227364f2bfc342047532c1212b05ae