CVE-2023-42374: Insufficient Information (NVD-CWE-noinfo)
value: An issue in mystenlabs Sui Blockchain before v.1.6.3 allow a remote attacker to execute arbitrary code and cause a denial of service via a crafted compressed script to the Sui node component.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-13T01:15Z
Repository: https://github.com/MystenLabs/sui
Language: Rust
Files changed: crates/mysten-network/src/codec.rs, crates/sui-node/src/lib.rs, narwhal/primary/src/primary.rs, narwhal/worker/src/worker.rs
Commit date: 2023-07-31 18:08:45 +0000
Commit message: Reduce anemo message limit to 1G (#13231)


Diff: diff --git a/crates/mysten-network/src/codec.rs b/crates/mysten-network/src/codec.rs
index aff2a7116..180cd2d9e 100644
--- a/crates/mysten-network/src/codec.rs
+++ b/crates/mysten-network/src/codec.rs
@@ -164,11 +164,11 @@ pub mod anemo {
         type Item = U;
         type Error = bcs::Error;
 
         fn decode(&mut self, buf: bytes::Bytes) -> Result<Self::Item, Self::Error> {
             let compressed_size = buf.len();
-            let mut snappy_decoder = snap::read::FrameDecoder::new(buf.reader());
+            let mut snappy_decoder = snap::read::FrameDecoder::new(buf.reader()).take(1 << 30);
             let mut bytes = Vec::with_capacity(compressed_size);
             snappy_decoder.read_to_end(&mut bytes)?;
             bcs::from_bytes(bytes.as_slice())
         }
     }
diff --git a/crates/sui-node/src/lib.rs b/crates/sui-node/src/lib.rs
index 25567e4de..2edb94315 100644
--- a/crates/sui-node/src/lib.rs
+++ b/crates/sui-node/src/lib.rs
@@ -795,13 +795,13 @@ impl SuiNode {
                     config.p2p_config.excessive_message_size(),
                 )))
                 .into_inner();
 
             let mut anemo_config = config.p2p_config.anemo_config.clone().unwrap_or_default();
-            // Set the max_frame_size to be 2 GB to work around the issue of there being too many
+            // Set the max_frame_size to be 1 GB to work around the issue of there being too many
             // staking events in the epoch change txn.
-            anemo_config.max_frame_size = Some(2 << 30);
+            anemo_config.max_frame_size = Some(1 << 30);
 
             // Set a higher default value for socket send/receive buffers if not already
             // configured.
             let mut quic_config = anemo_config.quic.unwrap_or_default();
             if quic_config.socket_send_buffer_size.is_none() {
diff --git a/narwhal/primary/src/primary.rs b/narwhal/primary/src/primary.rs
index ced452d05..fa5617566 100644
--- a/narwhal/primary/src/primary.rs
+++ b/narwhal/primary/src/primary.rs
@@ -316,13 +316,13 @@ impl Primary {
             quic_config.max_idle_timeout_ms = Some(30_000);
             // Enable keep alives every 5s
             quic_config.keep_alive_interval_ms = Some(5_000);
             let mut config = anemo::Config::default();
             config.quic = Some(quic_config);
-            // Set the max_frame_size to be 2 GB to work around the issue of there being too many
+            // Set the max_frame_size to be 1 GB to work around the issue of there being too many
             // delegation events in the epoch change txn.
-            config.max_frame_size = Some(2 << 30);
+            config.max_frame_size = Some(1 << 30);
             // Set a default timeout of 300s for all RPC requests
             config.inbound_request_timeout_ms = Some(300_000);
             config.outbound_request_timeout_ms = Some(300_000);
             config.shutdown_idle_timeout_ms = Some(1_000);
             config.connectivity_check_interval_ms = Some(2_000);
diff --git a/narwhal/worker/src/worker.rs b/narwhal/worker/src/worker.rs
index 7b16914dc..4cc67bca5 100644
--- a/narwhal/worker/src/worker.rs
+++ b/narwhal/worker/src/worker.rs
@@ -240,13 +240,13 @@ impl Worker {
             quic_config.max_idle_timeout_ms = Some(30_000);
             // Enable keep alives every 5s
             quic_config.keep_alive_interval_ms = Some(5_000);
             let mut config = anemo::Config::default();
             config.quic = Some(quic_config);
-            // Set the max_frame_size to be 2 GB to work around the issue of there being too many
+            // Set the max_frame_size to be 1 GB to work around the issue of there being too many
             // delegation events in the epoch change txn.
-            config.max_frame_size = Some(2 << 30);
+            config.max_frame_size = Some(1 << 30);
             // Set a default timeout of 300s for all RPC requests
             config.inbound_request_timeout_ms = Some(300_000);
             config.outbound_request_timeout_ms = Some(300_000);
             config.shutdown_idle_timeout_ms = Some(1_000);
             config.connectivity_check_interval_ms = Some(2_000);

Vulnerable code:             let mut snappy_decoder = snap::read::FrameDecoder::new(buf.reader());
            // Set the max_frame_size to be 2 GB to work around the issue of there being too many
            anemo_config.max_frame_size = Some(2 << 30);
            // Set the max_frame_size to be 2 GB to work around the issue of there being too many
            config.max_frame_size = Some(2 << 30);
            // Set the max_frame_size to be 2 GB to work around the issue of there being too many
            config.max_frame_size = Some(2 << 30);
Fixed code:             let mut snappy_decoder = snap::read::FrameDecoder::new(buf.reader()).take(1 << 30);
            // Set the max_frame_size to be 1 GB to work around the issue of there being too many
            anemo_config.max_frame_size = Some(1 << 30);
            // Set the max_frame_size to be 1 GB to work around the issue of there being too many
            config.max_frame_size = Some(1 << 30);
            // Set the max_frame_size to be 1 GB to work around the issue of there being too many
            config.max_frame_size = Some(1 << 30);