Add advisory for bindata

[kuahyeow]

Potential DoS (combined with constantized - see https://blog.presidentbeef.com/blog/2020/09/14/another-reason-to-avoid-constantize-in-rails/ for background) which was fixed in dmendel/bindata@d99f050 as part of bindata 2.4.10

No CVE yet

[reedloden]

@kuahyeow are you associated with the bindata project? If so, you can request a CVE via the GitHub Security Advisory process. Otherwise, I can ask GitHub to assign a CVE.

[kuahyeow]

@reedloden No, I am not associated with the bindata project. (For transparency, I am part of the GitLab team that found and reported this issue to the bindata mantainer - see also https://about.gitlab.com/releases/2021/06/01/security-release-gitlab-13-12-2-released/#update-bindata-dependency)

Otherwise, I can ask GitHub to assign a CVE.

Yes, that will be good, thanks!

[rschultheis]

Hello, I am with the GitHub Security Lab team. We are evaluating this to see if assigning a CVE makes sense CC @reedloden . Can someone articulate the security impact more clearly? The linked blog article discusses the use of constantize creates a memory leak, but in the linked commit there is not any code change involving constantize.

Is the "Potential DoS" simply due to the previous implementation being inneficient?

CC @kuahyeow could we get just a bit more details?

[kuahyeow]

Hello @rschultheis, thanks for reaching out.

I think since this is public information, I can expand on the details. The issue is that it was extremely slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>

So this, in combination with <user_input>.constantize means we have a (slow) CPU-based DoS. Note this is not an issue with BinData gem by itself - attacker needs to find a place where user input is used with constantize in the application.

Does this make sense ?

[rschultheis]

@kuahyeow yes that makes sense thanks. I've gone ahead and submited CVE-2021-32823 for this advisory with a CVSS of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L / low.

We have also published GHSA-hj56-84jw-67h6 for this.

[rschultheis]

Also I made this PR to add this advisory to this repo: #483

[reedloden]

This has been added. Thanks, all!