GHSA-3gjh-29fv-8hr6: 
Rust vulnerability analysis and mitigation

A high-severity vulnerability (GHSA-3gjh-29fv-8hr6) was discovered in Nervos CKB affecting versions <= 0.34.1. The vulnerability relates to the Snappy decompression functionality where an attacker could create messages with small compressed sizes but extremely large decompression lengths. This vulnerability was published on August 12, 2020, and was later patched in version 0.34.2 (GitHub Advisory).

The vulnerability exists in the Snappy decompression implementation where the system fails to verify the decompressed length before allocating memory. The issue was identified in the compression handling code, specifically in the network message processing component (CKB Source).

When exploited, this vulnerability allows an adversary to create network messages with compressed sizes within package limits but with decompressed lengths as large as 1GB. This can lead to excessive memory consumption during network message processing, potentially causing process termination due to out-of-memory errors, particularly on systems with limited memory resources (GitHub Advisory).

The vulnerability was patched in version 0.34.2 of Nervos CKB. The fix implements a check on the decompression length before allocating memory for the message, preventing potential out-of-memory situations (GitHub Advisory).