GO-2021-0082: High severity Facebook Thrift vulnerability

Q: Who can exploit this issue?

Any malicious client able to send crafted messages to an affected Golang Facebook Thrift server can trigger the condition. The listed vector requires network access and no privileges or user interaction.

Q: What is required to trigger the denial of service?

The attacker sends a short Thrift message that declares one or more containers with sizes larger than the actual payload. The affected server may perform a large memory allocation, potentially causing denial of service.

Q: Which deployments are affected?

Facebook Thrift versions before v2020.03.16.00 are affected when used for Golang Thrift servers. The provided data does not identify any configuration prerequisite or mitigation setting.

Q: What should teams do if they cannot patch immediately?

The provided information identifies the issue as remotely triggerable by malicious clients, but does not provide a documented workaround. Prioritize limiting untrusted client access to affected Thrift servers until they can be upgraded.

Published Mar 18, 2020

Updated

Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.03.16.00.

Affected Software

1 affected component

Facebook Thrift<2020.03.16.00

Event History

Mar 18, 2020

CVE Published

via OSV·01:15 AM

Data Sourced

via OSV·01:15 AM

DescriptionSeverity

Frequently Asked Questions

Who can exploit this issue?

Any malicious client able to send crafted messages to an affected Golang Facebook Thrift server can trigger the condition. The listed vector requires network access and no privileges or user interaction.

What is required to trigger the denial of service?

The attacker sends a short Thrift message that declares one or more containers with sizes larger than the actual payload. The affected server may perform a large memory allocation, potentially causing denial of service.

Which deployments are affected?

Facebook Thrift versions before v2020.03.16.00 are affected when used for Golang Thrift servers. The provided data does not identify any configuration prerequisite or mitigation setting.

What should teams do if they cannot patch immediately?

The provided information identifies the issue as remotely triggerable by malicious clients, but does not provide a documented workaround. Prioritize limiting untrusted client access to affected Thrift servers until they can be upgraded.

GO-2021-0082: High severity Facebook Thrift vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is required to trigger the denial of service?

Which deployments are affected?

What should teams do if they cannot patch immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is required to trigger the denial of service?

Which deployments are affected?

What should teams do if they cannot patch immediately?