Executive brief
bittorrent-dht is a Node.js library that implements the BitTorrent DHT (Distributed Hash Table) protocol. An attacker can send a specific series of messages to a listening peer to leak sensitive data from the process's internal memory, potentially exposing previously allocated buffers or other memory contents.
Technical details
The vulnerability is a remote memory disclosure (CWE-201) affecting bittorrent-dht prior to version 5.1.3. An attacker sends a specific series of messages to a listening peer, causing the process to reveal internal memory contents. The impact is mitigated by two factors: modern kernels zero out new memory pages before allocation, and Node.js Buffers are allocated from pre-allocated SlowBuffers rather than the V8 heap, so only previously allocated and deallocated Buffer memory can leak. The vulnerability requires network access to the DHT peer but no authentication. Fixed in version 5.1.3 and later.
Affected products
- feross bittorrent-dht prior to 5.1.3
Timeline
- 2020-09-01: disclosed