CVE-2020-26164: Uncontrolled Resource Consumption (CWE-400)
value: In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 5.5
Published: 2020-10-07T19:15Z
Repository: https://github.com/KDE/kdeconnect-kde
Language: C++
Files changed: core/backends/lan/lanlinkprovider.cpp
Commit date: 2020-10-02 12:52:08 +0200
Commit message: Limit number of connected sockets from unpaired devices

Thanks Matthias Gerstner <mgerstner@suse.de> for reporting this.

Diff: diff --git a/core/backends/lan/lanlinkprovider.cpp b/core/backends/lan/lanlinkprovider.cpp
index 542f658e..e479da0f 100644
--- a/core/backends/lan/lanlinkprovider.cpp
+++ b/core/backends/lan/lanlinkprovider.cpp
@@ -31,10 +31,12 @@
 #include "kdeconnectconfig.h"
 #include "qtcompat_p.h"
 
 #define MIN_VERSION_WITH_SSL_SUPPORT 6
 
+static const int MAX_UNPAIRED_CONNECTIONS = 42;
+
 LanLinkProvider::LanLinkProvider(
         bool testMode,
         quint16 udpBroadcastPort,
         quint16 udpListenPort
         )
@@ -578,10 +580,19 @@ void LanLinkProvider::addLink(const QString& deviceId, QSslSocket* socket, Netwo
         //qCDebug(KDECONNECT_CORE) << "Reusing link to" << deviceId;
         deviceLink = linkIterator.value();
         deviceLink->reset(socket, connectionOrigin);
     } else {
         deviceLink = new LanDeviceLink(deviceId, this, socket, connectionOrigin);
+        // Socket disconnection will now be handled by LanDeviceLink
+        disconnect(socket, &QAbstractSocket::disconnected, socket, &QObject::deleteLater);
+        bool isDeviceTrusted = KdeConnectConfig::instance().trustedDevices().contains(deviceId);
+        if (!isDeviceTrusted && m_links.size() > MAX_UNPAIRED_CONNECTIONS) {
+            qCWarning(KDECONNECT_CORE) << "Too many unpaired devices to remember them all. Ignoring " << deviceId;
+            socket->disconnectFromHost();
+            socket->deleteLater();
+            return;
+        }
         connect(deviceLink, &QObject::destroyed, this, &LanLinkProvider::deviceLinkDestroyed);
         m_links[deviceId] = deviceLink;
         if (m_pairingHandlers.contains(deviceId)) {
             //We shouldn't have a pairinghandler if we didn't have a link.
             //Crash if debug, recover if release (by setting the new devicelink to the old pairinghandler)

Fixed code: static const int MAX_UNPAIRED_CONNECTIONS = 42;

        // Socket disconnection will now be handled by LanDeviceLink
        disconnect(socket, &QAbstractSocket::disconnected, socket, &QObject::deleteLater);
        bool isDeviceTrusted = KdeConnectConfig::instance().trustedDevices().contains(deviceId);
        if (!isDeviceTrusted && m_links.size() > MAX_UNPAIRED_CONNECTIONS) {
            qCWarning(KDECONNECT_CORE) << "Too many unpaired devices to remember them all. Ignoring " << deviceId;
            socket->disconnectFromHost();
            socket->deleteLater();
            return;
        }