CyberRota Analysis
AI-GeneratedThe vulnerability affects the Coder platform, specifically in the `NewDataBuilder` function, which improperly allocates a byte slice based on an unvalidated `FileSize` parameter from a `DataUpload` message, potentially leading to denial-of-service conditions through excessive resource allocation. Organizations using versions 2.24.0 to 2.29.6, 2.32.6, 2.33.7, and 2.34.1 should prioritize patching to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2, or implement access restrictions to mitigate risks. This vulnerability is particularly relevant for teams managing remote development environments via Terraform.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.24.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `NewDataBuilder` in `provisionersdk/proto/dataupload.go` allocated a byte slice using the client-supplied `FileSize` from a `DataUpload` message without an upper-bound check. Although the DRPC wire limit is 4 MiB, the `FileSize` value itself was unconstrained. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates `FileSize` against an upper bound (`MaxFileSize = 100 MiB`) before allocation. As a workaround, restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts.
Related CVEs
Other vulnerabilities affecting the same vendor(s)