Resource exhaustion in Rustix - CVE-2024-43806

Vulnerability identifier: #VU101898

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-43806

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when scanning directories. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Rustix
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
Basesystem Module
openSUSE Leap
rage-encryption-bash-completion
rage-encryption-fish-completion
rage-encryption-zsh-completion
rage-encryption
gdk-pixbuf-loader-rsvg-64bit-debuginfo
librsvg-2-2-64bit
gdk-pixbuf-loader-rsvg-64bit
librsvg-2-2-64bit-debuginfo
rsvg-thumbnailer
librsvg-2-2-32bit-debuginfo
librsvg-2-2-32bit
gdk-pixbuf-loader-rsvg-32bit
gdk-pixbuf-loader-rsvg-32bit-debuginfo
librsvg-devel
gdk-pixbuf-loader-rsvg
rsvg-convert
typelib-1_0-Rsvg-2_0
librsvg-2-2
librsvg-2-2-debuginfo
gdk-pixbuf-loader-rsvg-debuginfo
librsvg-debugsource

Install updates from vendor's website.

Rustix - addressed in versions 0.35.15, 0.36.16, 0.37.25, 0.38.19
rage-encryption-bash-completion - update to 0.10.0+0-150500.3.6.1
rage-encryption-fish-completion - update to 0.10.0+0-150500.3.6.1
rage-encryption-zsh-completion - update to 0.10.0+0-150500.3.6.1
rage-encryption - update to 0.10.0+0-150500.3.6.1
gdk-pixbuf-loader-rsvg-64bit-debuginfo - update to 2.52.12-150400.3.9.1
librsvg-2-2-64bit - update to 2.52.12-150400.3.9.1
gdk-pixbuf-loader-rsvg-64bit - update to 2.52.12-150400.3.9.1
librsvg-2-2-64bit-debuginfo - update to 2.52.12-150400.3.9.1
rsvg-thumbnailer - update to 2.52.12-150400.3.9.1
librsvg-2-2-32bit-debuginfo - update to 2.52.12-150400.3.9.1
librsvg-2-2-32bit - update to 2.52.12-150400.3.9.1
gdk-pixbuf-loader-rsvg-32bit - update to 2.52.12-150400.3.9.1
gdk-pixbuf-loader-rsvg-32bit-debuginfo - update to 2.52.12-150400.3.9.1
librsvg-devel - update to 2.52.12-150400.3.9.1
gdk-pixbuf-loader-rsvg - update to 2.52.12-150400.3.9.1
rsvg-convert - update to 2.52.12-150400.3.9.1
typelib-1_0-Rsvg-2_0 - update to 2.52.12-150400.3.9.1
librsvg-2-2 - update to 2.52.12-150400.3.9.1
librsvg-2-2-debuginfo - update to 2.52.12-150400.3.9.1
gdk-pixbuf-loader-rsvg-debuginfo - update to 2.52.12-150400.3.9.1
librsvg-debugsource - update to 2.52.12-150400.3.9.1

• https://github.com/bytecodealliance/rustix/security/advisories/GHSA-c827-hfw6-qwvm
• https://github.com/imsnif/bandwhich/issues/284

• Denial of service in Rustix
• SUSE update for rage-encryption
• SUSE update for librsvg