CyberRota Analysis
AI-GeneratedThe gopacket library versions 1.6.0 and earlier are vulnerable due to improper handling of attacker-controlled values in the sFlow ExtendedGatewayFlow decoder, allowing for excessive slice allocations that can lead to a remote denial of service. This vulnerability can be exploited by sending specially crafted UDP datagrams, potentially consuming significant memory resources. Organizations using gopacket for packet processing should prioritize upgrading to version 1.6.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)