DoS Decompression Bomb

go.dos_decompression_bomb

Severity

critical

Resource

Resource Management

Language

Description

A decompression bomb is a type of denial-of-service (DoS) attack where a small compressed file is crafted to decompress into a very large file, consuming excessive system resources and potentially crashing the application or system.

Rationale

Decompression bombs exploit the disproportionate resource usage between compressed data size and decompressed data size.

In Go, using packages like compress/zlib without proper limits can lead to such vulnerabilities. Here’s an example demonstrating improper handling:

package main

import (
    "compress/zlib"
    "io"
    "os"
)

func processCompressedData(b io.Reader) {
    r, err := zlib.NewReader(b)
    if err != nil {
        panic(err)
    }
    defer r.Close()

    _, err = io.Copy(os.Stdout, r) // FLAW: No size limit leads to potential decompression bomb
    if err != nil {
        panic(err)
    }
}

In this example, decompressing data without size constraints can exhaust memory or disk resources, causing denial of service.

Remediation

Set Limits: Always set limits on the size of data being decompressed. Use a controlled buffer to manage memory consumption.
Monitor Resource Usage: Implement resource monitoring to detect unusual consumption patterns indicative of decompression attacks.
Validate Input: Perform validation on compressed data, ensuring integrity and expected compression ratios.
Use Specialized Libraries: Consider using libraries that offer built-in protections against decompression bombs.

By implementing these strategies, the risk of decompression bomb attacks can be effectively mitigated in Go applications.

The remediation example would look like this:

package main

import (
    "compress/zlib"
    "io"
    "os"
)

func processCompressedData(b io.Reader) {
    r, err := zlib.NewReader(b)
    if err != nil {
        panic(err)
    }
    defer r.Close()

    _, err = io.CopyN(os.Stdout, r, 2048) // Set N accordingly to your resources
    if err != nil {
        panic(err)
    }
}

References

CWE-409 : Improper Handling of Highly Compressed Data (Data Amplification).