CVE-2023-42374 (published 2024-02-13T01:15Z)

An issue in mystenlabs Sui Blockchain before v.1.6.3 allow a remote attacker to execute arbitrary code and cause a denial of service via a crafted compressed script to the Sui node component.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/MystenLabs/sui
commit_details: repo_url: https://github.com/MystenLabs/sui
author: Andrew Schran
author_date: 2023-07-31 14:08:45-04:00
msg: Reduce anemo message limit to 1G (#13231)
repository: repo_url: https://github.com/MystenLabs/sui
repo_name: MystenLabs/sui
description:  Sui, a next-generation smart contract platform with high throughput, low latency, and an asset-oriented programming model powered by the Move programming language
repo_language: Rust
owner: MystenLabs
file_changes: filename: codec.rs
change_type: ModificationType.MODIFY
diff: @@ -166,7 +166,7 @@ pub mod anemo {
 
         fn decode(&mut self, buf: bytes::Bytes) -> Result<Self::Item, Self::Error> {
             let compressed_size = buf.len();
-            let mut snappy_decoder = snap::read::FrameDecoder::new(buf.reader());
+            let mut snappy_decoder = snap::read::FrameDecoder::new(buf.reader()).take(1 << 30);
             let mut bytes = Vec::with_capacity(compressed_size);
             snappy_decoder.read_to_end(&mut bytes)?;
             bcs::from_bytes(bytes.as_slice())

programming_language: Rust
filename: lib.rs
change_type: ModificationType.MODIFY
diff: @@ -797,9 +797,9 @@ impl SuiNode {
                 .into_inner();
 
             let mut anemo_config = config.p2p_config.anemo_config.clone().unwrap_or_default();
-            // Set the max_frame_size to be 2 GB to work around the issue of there being too many
+            // Set the max_frame_size to be 1 GB to work around the issue of there being too many
             // staking events in the epoch change txn.
-            anemo_config.max_frame_size = Some(2 << 30);
+            anemo_config.max_frame_size = Some(1 << 30);
 
             // Set a higher default value for socket send/receive buffers if not already
             // configured.

programming_language: Rust
filename: primary.rs
change_type: ModificationType.MODIFY
diff: @@ -318,9 +318,9 @@ impl Primary {
             quic_config.keep_alive_interval_ms = Some(5_000);
             let mut config = anemo::Config::default();
             config.quic = Some(quic_config);
-            // Set the max_frame_size to be 2 GB to work around the issue of there being too many
+            // Set the max_frame_size to be 1 GB to work around the issue of there being too many
             // delegation events in the epoch change txn.
-            config.max_frame_size = Some(2 << 30);
+            config.max_frame_size = Some(1 << 30);
             // Set a default timeout of 300s for all RPC requests
             config.inbound_request_timeout_ms = Some(300_000);
             config.outbound_request_timeout_ms = Some(300_000);

programming_language: Rust
filename: worker.rs
change_type: ModificationType.MODIFY
diff: @@ -242,9 +242,9 @@ impl Worker {
             quic_config.keep_alive_interval_ms = Some(5_000);
             let mut config = anemo::Config::default();
             config.quic = Some(quic_config);
-            // Set the max_frame_size to be 2 GB to work around the issue of there being too many
+            // Set the max_frame_size to be 1 GB to work around the issue of there being too many
             // delegation events in the epoch change txn.
-            config.max_frame_size = Some(2 << 30);
+            config.max_frame_size = Some(1 << 30);
             // Set a default timeout of 300s for all RPC requests
             config.inbound_request_timeout_ms = Some(300_000);
             config.outbound_request_timeout_ms = Some(300_000);

programming_language: Rust