{"schema":"threatline.record/2","record":{"id":"GHSA-vvp8-22p8-x954","aliases":["GHSA-vvp8-22p8-x954"],"summary":"Denial of Service via Uncontrolled Resource Consumption When Importing TAR/Zip Archive","details":"### Summary\r\n\r\nThe application fails to enforce any limit on the number of entries it will process from a user-supplied tar/zip archive. After successfully hashing all entries, the software enters an indexing routine that loops over every entry performing per-entry work with no upper bound, timeout, or throttling. A crafted tar/zip archive containing an excessively large number of entries causes unbounded memory allocation during this loop, exhausting available system memory. The application's UI thread is blocked for the duration of this operation, so the process does not respond to cancel or close requests, and the memory exhaustion degrades or halts other applications running on the same system. Recovery requires the user to forcibly terminate the process (e.g., via Task Manager / kill -9); the OS out-of-memory killer, if configured at all, only intervenes as a last resort after significant system-wide impact, resulting in a denial-of-service condition and loss of system availability.\r\n\r\nThe below sections outline the TAR case only.  The Zip case is similar.\r\n\r\n### Details\r\n\r\nTarFileSystem.java:\r\n```java\r\nvoid mount(TaskMonitor monitor) throws IOException, CancelledException {\r\n\t\ttry (TarArchiveInputStream tarInput =\r\n\t\t\tnew TarArchiveInputStream(provider.getInputStream(0))) {\r\n\t\t\tTarArchiveEntry tarEntry;\r\n\t\t\twhile ((tarEntry = tarInput.getNextEntry()) != null) {\r\n\t\t\t\tmonitor.setMessage(tarEntry.getName());\r\n\t\t\t\tmonitor.checkCancelled();\r\n\r\n\t\t\t\tint fileNum = fileCount++;\r\n\t\t\t\tString linkName = tarEntry.getLinkName();\r\n\t\t\t\tTarMetadata tmd = new TarMetadata(tarEntry, fileNum);\r\n\t\t\t\tGFile newFile = !tarEntry.isSymbolicLink()\r\n\t\t\t\t\t\t? fsIndex.storeFile(tarEntry.getName(), fileCount, tarEntry.isDirectory(),\r\n\t\t\t\t\t\t\ttarEntry.getSize(), tmd)\r\n\t\t\t\t\t\t: fsIndex.storeSymlink(tarEntry.getName(), fileCount, linkName,\r\n\t\t\t\t\t\t\tlinkName.length(), tmd);\r\n\r\n\t\t\t\tif (!tarEntry.isSymbolicLink() &&\r\n\t\t\t\t\ttarEntry.getSize() < FileCache.MAX_INMEM_FILESIZE) {\r\n\t\t\t\t\t// because tar files are sequential access, we cache smaller files if they\r\n\t\t\t\t\t// will fit in a in-memory ByteProvider\r\n\t\t\t\t\ttry (ByteProvider bp =\r\n\t\t\t\t\t\tfsService.getDerivedByteProvider(fsFSRL.getContainer(), newFile.getFSRL(),\r\n\t\t\t\t\t\t\tnewFile.getPath(), tarEntry.getSize(), () -> tarInput, monitor)) {\r\n\t\t\t\t\t\tfsIndex.updateFSRL(newFile,\r\n\t\t\t\t\t\t\tnewFile.getFSRL().withMD5(bp.getFSRL().getMD5()));\r\n\t\t\t\t\t}\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t\t}\r\n\t}\r\n```\r\n\r\n### Stack Trace\r\n\r\n```\r\n2026-09-03 17:06:34 ERROR (TaskBuilderTask) Task Error: Adding Source Files - Uncaught Exception: java.lang.OutOfMemoryError: Java heap space java.lang.OutOfMemoryError: Java heap space\r\n\tat ghidra.formats.gfilesystem.FSUtilities.streamCopy(FSUtilities.java:375)\r\n\tat ghidra.formats.gfilesystem.FileSystemService.getDerivedByteProvider(FileSystemService.java:427)\r\n\tat ghidra.file.formats.tar.TarFileSystem.mount(TarFileSystem.java:84)\r\n\tat ghidra.file.formats.tar.TarFileSystemFactory.create(TarFileSystemFactory.java:63)\r\n\tat ghidra.file.formats.tar.TarFileSystemFactory.create(TarFileSystemFactory.java:37)\r\n\tat ghidra.formats.gfilesystem.factory.FileSystemFactoryMgr.mountUsingFactory(FileSystemFactoryMgr.java:166)\r\n\tat ghidra.formats.gfilesystem.factory.FileSystemFactoryMgr.probe(FileSystemFactoryMgr.java:326)\r\n\tat ghidra.formats.gfilesystem.FileSystemService.probeFileForFilesystem(FileSystemService.java:718)\r\n\tat ghidra.formats.gfilesystem.FileSystemService.probeFileForFilesystem(FileSystemService.java:676)\r\n\tat ghidra.plugins.importer.batch.BatchInfo.processAsFS(BatchInfo.java:303)\r\n\tat ghidra.plugins.importer.batch.BatchInfo.doAddFile(BatchInfo.java:230)\r\n\tat ghidra.plugins.importer.batch.BatchInfo.addFile(BatchInfo.java:198)\r\n\tat ghidra.plugins.importer.batch.BatchInfo.doAddFiles(BatchInfo.java:503)\r\n\tat ghidra.plugins.importer.batch.BatchInfo$AddFilesRunnable.monitoredRun(BatchInfo.java:542)\r\n\tat ghidra.util.task.TaskBuilder$TaskBuilderTask.run(TaskBuilder.java:306)\r\n\tat ghidra.util.task.Task.monitoredRun(Task.java:134)\r\n\tat ghidra.util.task.TaskRunner.lambda$startTaskThread$0(TaskRunner.java:106)\r\n\tat ghidra.util.task.TaskRunner$$Lambda/0x00000000406f3350.run(Unknown Source)\r\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1090)\r\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:614)\r\n\tat java.base/java.lang.Thread.runWith(Thread.java:1529)\r\n\tat java.base/java.lang.Thread.run(Thread.java:1516)\r\n```\r\n\r\n### Impact\r\n\r\n1. **Application-level DoS**: Main/UI thread is blocked; the application becomes fully unresponsive to user input, including cancel and window-close actions.\r\n2. **System-level DoS**: Uncontrolled memory allocation exhausts system RAM and Cache, degrading or freezing other running applications.\r\n5. **Availability of recovery**: No graceful recovery path. Requires manual, forced process termination by the user (or an OS-level OOM killer, if present, as a last-resort backstop). Depending upon the configuration, it may cause the machine to reboot itself to correct things.\r\n6. **Low attacker cost / high impact asymmetry**: A relatively small archive file (large entry count does not necessarily mean large file size) can trigger disproportionate resource consumption on the victim system.\r\n","categories":["Unclassified"],"product":"ghidra","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vvp8-22p8-x954","source_modified_at":"2026-10-22T12:07:25Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"ecosystem":"ghidra","name":"ghidra"},"range":"< 12.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vvp8-22p8-x954","source_modified_at":"2026-10-22T12:07:25Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"ecosystem":"ghidra","name":"ghidra"},"version":"12.2"}],"cvss":8.2,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-22T12:07:25Z","modified_at":"2026-10-22T12:07:25Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vvp8-22p8-x954","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-22T12:07:25Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-22T12:07:25Z","content_hash":"a9ef1d65cf4a539e0bb2364bf261fd6a456ab0bfb9d8e4b97b524cdf54881cd8"}}