Vulnerability Description
Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory (OOM) process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based on the declared dataframe size, which may come from an untrusted source. When `Vec::with_capacity` fails to allocate, the default Rust allocator will abort the current process, killing all threads. This affects only sync (non-Tokio) implementation. Async version also does not limit memory, but does not use `with_capacity`, so DoS can happen only when bytes for oversized dataframe or message actually got delivered by the attacker. The crashes are fixed in version 0.26.5 by imposing default dataframe size limits. Affected users are advised to update to this version. Users unable to upgrade are advised to filter websocket traffic externally or to only accept trusted traffic.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rust-Websocket Project | Rust-Websocket | < 0.26.5 |
| Fedoraproject | Fedora | 35 |
Related Weaknesses (CWE)
References
- https://github.com/websockets-rs/rust-websocket/commit/cbf6e9983e839d2ecad86de8cPatchThird Party Advisory
- https://github.com/websockets-rs/rust-websocket/security/advisories/GHSA-qrjv-rfThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://github.com/websockets-rs/rust-websocket/commit/cbf6e9983e839d2ecad86de8cPatchThird Party Advisory
- https://github.com/websockets-rs/rust-websocket/security/advisories/GHSA-qrjv-rfThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2022-35922?
CVE-2022-35922 is a vulnerability with a CVSS score of 7.5 (HIGH). Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory (OOM) process abort in a client or a server. The...
How severe is CVE-2022-35922?
CVE-2022-35922 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-35922?
Check the references section above for vendor advisories and patch information. Affected products include: Rust-Websocket Project Rust-Websocket, Fedoraproject Fedora.