ghidra: Denial of Service via Filesystem Inode Exhaustion During Theme Import

Summary

A maliciously crafted theme archive containing a very large number of files can cause the theme importer to exhaust the available filesystem inodes. Once inode pool is exhausted, subsequent imports and file creation operations fail, preventng ghidra and other system services from creating files and resulting in a denial-of-service condition and loss of system availability.

Details

readZipTheme() is responsible for extracting theme data and icons from a theme ZIP archive. In particular, icons are extracted from the image/ subdirectory of the archive to /home/USERNAME/.config/ghidra/Ghidra*/images on the host filesystem. If an archive contains a very large number of icon files, the extraction can exhaust all available inode pool and disk space, preventing further imports. Additionally, applications on the affected system that depend on disk I/O may become unable to function properly.

Impact

The vulnerability allows an attacker to cause uncontrolled resource consumption by supplying a malicious archive with a very large number of files.

This can result in:

1. excessive disk-space consumption;
2. excessive CPU and I/O usage during decompression;
3. failure of subsequent import operations;
4. inability to perform other operations when inode pool is exhausted; and potentially denial of service if sufficient resources are consumed.

Note: Once available inode pool is exhausted, other system-wide applications that depend on disk I/O may fail or become unable to perform write operations.