GHSA-pxw4-94j3-v9pf: SurrealDB CPU exhaustion via custom functions result in total DoS
N/A
Basic Information
RustTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| surrealdb | rust | >= 2.2.0, < 2.2.2 | 2.2.2 |
| surrealdb | rust | >= 2.1.0, < 2.1.5 | 2.1.5 |
| surrealdb | rust | < 2.0.5 | 2.0.5 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability describes a CPU exhaustion issue due to nested FOR loops in custom SurrealDB functions. The primary patch location, as stated in the vulnerability description ('A patch has been introduced that adds a check in the ForEachStatement'), points directly to the process method within ForEachStatement. Analysis of commit fd286b9b3734d44f50b1bfdfdc918b210b438ae1 confirms that crates/core/src/sql/statements/foreach.rs was modified to add timeout and cooperative yielding checks within the loop of the ForEachStatement::process method. This function is therefore directly vulnerable as it contained the flawed loop execution logic.
Additionally, the fnc::script::main::run function, which is responsible for executing these custom functions (scripts), was also patched in the same commit to include a general script execution timeout. This function processes the malicious input (the script) and, before its own patch, would have allowed the script to run for an extended period if the underlying ForEachStatement didn't yield. Thus, it's also considered relevant, though the root of the loop exhaustion is in ForEachStatement::process.