CVE-2023-6180: tokio-boring vulnerable to resource exhaustion via memory leak

December 5, 2023

The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exhaustion. The set_ex_data function used by the library did not deallocate memory used by pre-existing data in memory each time after completing a TLS connection causing the program to consume more resources with each new connection.

References

github.com/advisories/GHSA-pjrj-h4fg-6gm4
github.com/cloudflare/boring
github.com/cloudflare/boring/commit/a32783374f2682e6949fdb713910b1b9f103d3ed
github.com/cloudflare/boring/security/advisories/GHSA-pjrj-h4fg-6gm4
nvd.nist.gov/vuln/detail/CVE-2023-6180

Code Behaviors & Features

Detect and mitigate CVE-2023-6180 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →