{"schema":"threatline.record/2","record":{"id":"GHSA-j5q9-fhqg-q995","aliases":["GHSA-j5q9-fhqg-q995"],"summary":"Denial of Service via Filesystem Inode Exhaustion During Extension Import","details":"### Summary\r\n\r\nA maliciously crafted extension archive containing a very large number of files can cause the extension importer to exhaust the available filesystem inodes. Once inode pool is exhausted, subsequent imports and file creation operations fail, preventing ghidra and other system services from creating files and resulting in a denial-of-service condition and loss of system availability.\r\n\r\n### Details\r\n\r\n`unzipToInstallationFolder()` is responsible for extracting Ghidra extension ZIP archives. Files from the archive are extracted directly to `/home/USERNAME/.config/ghidra/ghidra*/Extensions` on the host filesystem. If an archive contains very large number of files, the extraction can exhaust all available disk space or inode pool, preventing subsequent imports. Additionally, other applications on the affected system that depend on disk I/O may fail or become unable to perform required write operations.\r\n\r\n### Stack Trace\r\n\r\n```\r\nERROR (ExtensionUtils) Error Installing Extension: Unexpected error installing extension java.io.IOException: No space left on device\r\n\tat java.base/java.io.FileOutputStream.writeBytes(Native Method)\r\n\tat java.base/java.io.FileOutputStream.write(FileOutputStream.java:352)\r\n\tat java.base/java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:123)\r\n\tat java.base/java.io.BufferedOutputStream.write(BufferedOutputStream.java:188)\r\n\tat org.apache.commons.io.IOUtils.copyLarge(IOUtils.java:1457)\r\n\tat org.apache.commons.io.IOUtils.copy(IOUtils.java:1081)\r\n\tat org.apache.commons.io.IOUtils.copyLarge(IOUtils.java:1429)\r\n\tat org.apache.commons.io.IOUtils.copy(IOUtils.java:1059)\r\n\tat ghidra.util.extensions.ExtensionUtils.writeZipEntryToFile(ExtensionUtils.java:634)\r\n\tat ghidra.util.extensions.ExtensionUtils.unzipToInstallationFolder(ExtensionUtils.java:597)\r\n\tat ghidra.util.extensions.ExtensionUtils.install(ExtensionUtils.java:103)\r\n\tat ghidra.framework.project.extensions.ExtensionInstaller.lambda$install$0(ExtensionInstaller.java:97)\r\n\tat ghidra.util.task.TaskLauncher$2.run(TaskLauncher.java:115)\r\n\tat ghidra.util.task.Task.monitoredRun(Task.java:134)\r\n\tat ghidra.util.task.TaskRunner.lambda$startTaskThread$0(TaskRunner.java:106)\r\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1090)\r\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:614)\r\n\tat java.base/java.lang.Thread.run(Thread.java:1516)\r\n\tSuppressed: java.io.IOException: No space left on device\r\n\t\tat java.base/java.io.FileOutputStream.writeBytes(Native Method)\r\n\t\tat java.base/java.io.FileOutputStream.write(FileOutputStream.java:352)\r\n\t\tat java.base/java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:123)\r\n\t\tat java.base/java.io.BufferedOutputStream.flush(BufferedOutputStream.java:203)\r\n\t\tat java.base/java.io.FilterOutputStream.close(FilterOutputStream.java:184)\r\n\t\tat ghidra.util.extensions.ExtensionUtils.writeZipEntryToFile(ExtensionUtils.java:630)\r\n\t\t... 9 more\r\n \r\nERROR (IndexedV1LocalFileSystem) Failed to flush index file java.io.IOException: error occurred while writing filesystem index: /home/yuvraj/buc.rep/versioned/~index.tmp                           /////////       INODE COUNT IS EXHAUSTED THEREFORE NO WRITE OPERATION WILL SUCCEEDD\r\n\tat ghidra.framework.store.local.IndexedLocalFileSystem.writeIndex(IndexedLocalFileSystem.java:314)\r\n\tat ghidra.framework.store.local.IndexedLocalFileSystem.flushIndex(IndexedLocalFileSystem.java:269)\r\n\tat ghidra.framework.store.local.IndexedLocalFileSystem.dispose(IndexedLocalFileSystem.java:198)\r\n```\r\n\r\n```\r\nyuvraj@archlinux ~]$ ls ~/.config/ghidra/ghidra_12.1.2_DEV/Extensions/\r\nfile_00000000.txt  file_00000004.txt  file_00000008.txt  file_00000012.txt  file_00000016.txt  file_00000020.txt  file_00000024.txt  file_00000028.txt  file_00000032.txt  file_00000036.txt  GhidraFindcrypt\r\nfile_00000001.txt  file_00000005.txt  file_00000009.txt  file_00000013.txt  file_00000017.txt  file_00000021.txt  file_00000025.txt  file_00000029.txt  file_00000033.txt  file_00000037.txt\r\nfile_00000002.txt  file_00000006.txt  file_00000010.txt  file_00000014.txt  file_00000018.txt  file_00000022.txt  file_00000026.txt  file_00000030.txt  file_00000034.txt  file_00000038.txt\r\nfile_00000003.txt  file_00000007.txt  file_00000011.txt  file_00000015.txt  file_00000019.txt  file_00000023.txt  file_00000027.txt  file_00000031.txt  file_00000035.txt  file_00000039.txt  ... // Output omitted\r\n```\r\n\r\n### Impact\r\n\r\nThe vulnerability allows an attacker to cause uncontrolled resource consumption by supplying a malicious archive with a very large number of files.\r\n\r\nThis can result in:\r\n1. excessive disk-space consumption;\r\n2. excessive CPU and I/O usage during decompression;\r\n3. failure of subsequent import operations;\r\n6. inability to perform other operations when inode pool is exhausted; and potentially denial of service if sufficient resources are consumed.\r\n\r\n**Note: Once available inode pool is exhausted, other system-wide applications that depend on disk I/O may fail or become unable to perform write operations.**","categories":["Unclassified"],"product":"ghidra","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-j5q9-fhqg-q995","source_modified_at":"2026-10-22T12:08:21Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"ecosystem":"ghidra","name":"ghidra"},"range":"< 12.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-j5q9-fhqg-q995","source_modified_at":"2026-10-22T12:08:21Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"ecosystem":"ghidra","name":"ghidra"},"version":"12.2"}],"cvss":8.3,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-22T12:08:21Z","modified_at":"2026-10-22T12:08:21Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-j5q9-fhqg-q995","fetched_at":"2026-10-23T21:10:45.942435Z","source_modified_at":"2026-10-22T12:08:21Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-22T12:08:21Z","content_hash":"bda27bb62d7a1843bb180d09505b52b8c77d6934cb638f13b4c6a6fa2889ca10"}}