[security] Fix panics on malformed input + channel races in controller #6

New issue

Open

opened 2026-03-22 16:36:55 +00:00 by Virgil · 2 comments

Virgil commented

2026-03-22 16:36:55 +00:00

Member

AX sweep findings:

HIGH — Panic on malformed UEPS header fields, remote input crashes parser (reader.go:53-72)
HIGH — Send-on-closed-channel panic in controller (controller.go:46, :54, :90, :107)
HIGH — Nil identity dereference in keepalive path crashes transport (transport.go:805)
MEDIUM — No access control on sensitive worker commands (worker.go:74-85)
MEDIUM — UEPS parser memory exhaustion via oversized TLVs (reader.go:24-54)

Fix all, add tests.

AX sweep findings: 1. HIGH — Panic on malformed UEPS header fields, remote input crashes parser (reader.go:53-72) 2. HIGH — Send-on-closed-channel panic in controller (controller.go:46, :54, :90, :107) 3. HIGH — Nil identity dereference in keepalive path crashes transport (transport.go:805) 4. MEDIUM — No access control on sensitive worker commands (worker.go:74-85) 5. MEDIUM — UEPS parser memory exhaustion via oversized TLVs (reader.go:24-54) Fix all, add tests.

Virgil commented

2026-03-22 18:48:03 +00:00

Author

Member

Codex Fix Attempt

Codex attempted fixes but could not commit (sandbox .git lock). The original findings from the issue body remain valid:

HIGH — Panic on malformed UEPS headers (reader.go:53-72)
HIGH — Send-on-closed-channel in controller (controller.go:46-107)
HIGH — Nil identity dereference in keepalive (transport.go:805)
MEDIUM — No access control on worker commands (worker.go:74-85)
MEDIUM — UEPS memory exhaustion via oversized TLVs (reader.go:24-54)

## Codex Fix Attempt Codex attempted fixes but could not commit (sandbox .git lock). The original findings from the issue body remain valid: 1. HIGH — Panic on malformed UEPS headers (reader.go:53-72) 2. HIGH — Send-on-closed-channel in controller (controller.go:46-107) 3. HIGH — Nil identity dereference in keepalive (transport.go:805) 4. MEDIUM — No access control on worker commands (worker.go:74-85) 5. MEDIUM — UEPS memory exhaustion via oversized TLVs (reader.go:24-54)

Virgil commented

2026-03-23 12:04:37 +00:00

Author

Member

Security Scan: Attack Vector Map

Entry	Input	Flows Into	Validation	Vector
ueps.ReadAndVerify (reader.go:27)	Raw TLV stream	Parse→HMAC→ParsedPacket	1MiB cap, HMAC required	Unknown tags accepted into signed data, CPU/mem per frame
Dispatcher.Dispatch (dispatcher.go:101)	Parsed UEPS packet	Threat gate→handler	Nil check, threat threshold	Any HMAC-valid packet under threshold reaches handlers, no auth
levin.ReadPacket (connection.go:112)	Raw Levin bytes	Decode→allocate→ReadFull	33-byte header, sig check, 100MB cap	100MB alloc per packet = memory DoS
levin.DecodeStorage (storage.go:454)	Portable-storage payload	Section/value/array decode	Signature/version, truncation	No caps on section/array/string counts, varint → large make()
node.ReadBundle (bundle.go:354)	Network bundle	Bundle decode	(see log for full details)

Common themes: Memory DoS via large allocations, no auth at dispatch layer, unknown extensions accepted.

## Security Scan: Attack Vector Map | Entry | Input | Flows Into | Validation | Vector | |---|---|---|---|---| | ueps.ReadAndVerify (reader.go:27) | Raw TLV stream | Parse→HMAC→ParsedPacket | 1MiB cap, HMAC required | Unknown tags accepted into signed data, CPU/mem per frame | | Dispatcher.Dispatch (dispatcher.go:101) | Parsed UEPS packet | Threat gate→handler | Nil check, threat threshold | Any HMAC-valid packet under threshold reaches handlers, no auth | | levin.ReadPacket (connection.go:112) | Raw Levin bytes | Decode→allocate→ReadFull | 33-byte header, sig check, 100MB cap | 100MB alloc per packet = memory DoS | | levin.DecodeStorage (storage.go:454) | Portable-storage payload | Section/value/array decode | Signature/version, truncation | No caps on section/array/string counts, varint → large make() | | node.ReadBundle (bundle.go:354) | Network bundle | Bundle decode | (see log for full details) | **Common themes**: Memory DoS via large allocations, no auth at dispatch layer, unknown extensions accepted.