[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 14 Oct 2016 02:53:13 +0000
From: 张开翔 <zhangkaixiang@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: docker2aci: infinite loop in deps walking(CVE-2016-8579)
Hello,
It was found that docker2aci fall into an infinite loop while traversing the dependency ancestry of a malformed image file.
,this flaw may cause excessive CPU cycles & resources consume on the host. The happens because no essential check for duplicated
image ID found in getAncestry() in docker2aci,
CVE-2016-8579 was assigned to this flaw by cve-assign@...re.org<mailto:cve-assign@...re.org>. Here the reply from CVE Assignment Team:
docker2aci is apparently a library [...] and we almost always recognize
the potential for an unattended use case for any library.
[...]
Someone can call the ConvertSavedFile function from an arbitrary
application. [...] It might be automated with cron or a similar unattended
tool that runs in an unrestricted (non-container) environment. Thus,
there is an availability impact because no human is around to notice
the CPU usage.
Use CVE-2016-8579.
References:
https://github.com/appc/docker2aci/issues/203(issue)
https://github.com/lucab/docker2aci/commit/54331ec7020e102935c31096f336d31f6400064f(patch)
Please, use it in the public communications regarding this flaw.
Best regards,
Kaixiang Zhang of Gear Team, Qihoo 360
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
