CVE-2023-23626: ipfs go-bitfield

Vulnerability summary

CVE-2023-23626 is a high (CVSS 7.5) vulnerability in ipfs go-bitfield. EPSS estimates a 0.91% chance of exploitation in the next 30 days, higher than 59.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-02-2023
   PublishedVulnerability first disclosed.
2. 10-03-2025
   Last modifiedVulnerability information updated.

Description

go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of `NewBitfield` and `FromBytes` functions, an attacker can trigger `panic`s. This happen when the `size` is a not a multiple of `8` or is negative. There were already a note in the `NewBitfield` documentation, however known users of this package are subject to this issue. Users are advised to upgrade. Users unable to upgrade should ensure that `size` is a multiple of 8 before calling `NewBitfield` or `FromBytes`.

• CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
• CWE-1284Improper Validation of Specified Quantity in InputThe product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.