CVE-2024-32984: 
Rust vulnerability analysis and mitigation

Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. A vulnerability was discovered in the Rust implementation of the Yamux stream multiplexer (versions 0.13.0 and up to 0.13.1) where the vector used for pending frames is not bounded in length. The vulnerability was disclosed on May 1, 2024, and tracked as CVE-2024-32984 (GitHub Advisory).

The vulnerability exists in the implementation's handling of pending frames. Every time the Yamux protocol requires sending a new frame, it gets appended to an unbounded vector. This can be triggered remotely in multiple ways, such as opening a new libp2p Identify stream or sending a Yamux Ping frame. The vulnerability has been assigned a CVSS v3.1 score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (GitHub Advisory).

An attacker can cause a remote node to run out of memory, ultimately leading to the process being terminated by the operating system. The attack can be amplified depending on the application protocols running on top of rust-libp2p. For example, protocols that send large amounts of data (e.g., 10 MB) in response to small requests (100-200 bytes) can result in significant memory consumption. Additionally, the attack increases the victim's CPU load, making memory allocation CPU-limited (GitHub Advisory).

The vulnerability can be exploited by preventing the victim from sending out data using TCP's receive window mechanism. By not reading from the TCP connection, the receive window never increases, and the victim cannot send new data. This causes Yamux's queue of pending frames to grow indefinitely, only being drained when the underlying TCP connection is closed (GitHub Advisory).

The vulnerability has been patched in version 0.13.2 of the Yamux implementation. The fix introduces a MAX_FRAME_BUFFER constant set to 2000 frames to limit the pending frames vector size (Rust Commit).