Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-2529

CVE-2022-2529:
Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-2529
GHSA ID
GHSA-9rpw-2h95-666c
EPSS Score
0.5876%
CWE
CWE-20
Published
10/1/2022
Updated
10/2/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/cloudflare/goflow/v3go< 3.4.43.4.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing input validation on size fields in packet decoding functions. The patches explicitly add constraints like MAX_FLOWS_PER_PACKET, MAX_AS_PATH_LENGTH, and MAX_SAMPLES_PER_PACKET to these functions. The pre-patch code allocated memory based directly on attacker-controlled packet fields without sanitization, enabling memory exhaustion attacks. The affected functions are clearly identified in the commit diffs (netflow.go and sflow.go), and the CWE mappings (CWE-20/CWE-400) directly correlate to these missing validations.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** s*low ***o** p**k*** prior to v*rsion *.*.* *o*s not *mploy su**i*i*nt p**k*t s*nitis*tion w*i** **n l*** to * **ni*l o* s*rvi** *tt**k. *tt**k*rs **n *r**t m*l*orm** p**k*ts **usin* t** pro**ss to *onsum* *u** *mounts o* m*mory r*sult

Reasoning

T** vuln*r**ility st*ms *rom missin* input v*li**tion on siz* *i*l*s in p**k*t ***o*in* *un*tions. T** p*t***s *xpli*itly *** *onstr*ints lik* M*X_*LOWS_P*R_P**K*T, M*X_*S_P*T*_L*N*T*, *n* M*X_S*MPL*S_P*R_P**K*T to t**s* *un*tions. T** pr*-p*t** *o**