Description
Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesystem inodes, causing project writes and other processes to fail.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
NationalSecurityAgency ghidra
Default version status: unaffected
0 to < 12.2affected
pkg:github/NationalSecurityAgency/ghidraReferences
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-j5q9-fhqg-q995 ↗
- https://github.com/NationalSecurityAgency/ghidra/commit/7cb4e778efb69acb1919f841ad46d0da36e77eeb ↗
- https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build ↗
- https://github.com/NationalSecurityAgency/ghidra ↗
- https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-extension-archive-install ↗