5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-54p8-x2m9-c593

GHSA-54p8-x2m9-c593: malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability

Several extraction and scanning code paths registered late defers which could leak resources and exhaust system resources.

Fix: #1354, #1355, #1356, #1361

Acknowledgements

Thank you to Oleh Konko from 1seal for discovering and reporting all six of these issues.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-54p8-x2m9-c593

GHSA-54p8-x2m9-c593:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/chainguard-dev/malcontent	go	< 1.21.0	1.21.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-54p8-x2m9-c593, is a resource exhaustion issue caused by improper resource management in multiple functions across the chainguard-dev/malcontent codebase. The root cause is a consistent programming error where resources such as file descriptors, memory buffers, and pooled objects (like scanners) were acquired, but the defer statements to release them were placed late in the function body.

In Go, defer schedules a function call to be run immediately before the surrounding function returns. The vulnerability arises when an error occurs after a resource has been acquired but before the corresponding defer statement is registered. In such cases, the function returns early due to the error, and the cleanup code is never executed, leading to a resource leak.

Repeatedly triggering these error paths could cause the application to exhaust available file descriptors or memory, leading to a denial of service. The fix applied across all affected files was to move the defer statement to execute immediately after the resource is successfully acquired, ensuring that the resource is always released regardless of subsequent errors.

Vulnerable functions

action.scanSinglePath

pkg/action/scan.go

The function acquired multiple resources (file handles, buffers from a pool, and scanners from a pool) but used a single deferred function at the end to release them. If an error occurred after a resource was acquired but before the deferred function was registered, that resource would be leaked. The fix was to add individual `defer` statements immediately after each resource acquisition.

archive.ExtractDeb

pkg/archive/deb.go

The function opens a file descriptor (`fd`) and loads a deb file (`df`), but the `defer` to close them was registered late. An error during `deb.Load(fd, f)` would leak the file descriptor `fd`. The fix moves the `defer` statements to immediately follow the resource acquisition.

archive.ExtractGzip

pkg/archive/gzip.go

The function acquired several resources (buffer, file handles, gzip reader) but deferred their release in a single block at the end. An error in the intermediate steps (e.g., creating the output file) would cause leaks of previously acquired resources. The fix adds `defer` statements immediately after each resource is acquired.

archive.ExtractZlib

pkg/archive/zlib.go

Similar to other extraction functions, `ExtractZlib` acquired multiple resources (buffer, file handles, zlib reader) but used a late deferred function to release them. This could lead to resource leaks if any operation failed before the defer block was reached.

archive.ExtractBz2

pkg/archive/bz2.go

The function was vulnerable to leaking resources (buffer from a pool, input and output file handles) because it deferred their cleanup in a function at the end. An early return from an error would bypass this cleanup logic.

archive.ExtractRPM

pkg/archive/rpm.go

Within a loop processing a CPIO archive, the function would create a file but did not use `defer` to ensure it was closed. An error during the file writing process would cause the file descriptor to leak. The fix refactored the file extraction logic into a new helper function, `extractFileFromCPIO`, which correctly uses `defer` to manage the file resource.

action.Diff

pkg/action/diff.go

The function created channels (`srcCh`, `destCh`) and opened files, but the `defer` statements to close them were registered late in the function's execution. An error occurring before these `defer` statements would lead to leaked channels or file descriptors.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.