Denial of Service attack on windows app using netty

The vulnerability was tested on the 4.1.112.Final version.

The security analyst tried the same technique for C:\proc\sys\net\core\somaxconn with a lot of values to impact Netty but the only things that works is the "larger than 1 GB file" technique. https://github.com/netty/netty/blob/c0fdb8e9f8f256990e902fcfffbbe10754d0f3dd/common/src/main/java/io/netty/util/NetUtil.java#L186

Impact

By loading the "file larger than 1 GB" into the memory, the Netty library exceeds the JVM memory limit and causes a crash in the java Windows application.

This behaviour occurs 100% of the time in both Server mode and Client mode if the large file exists.

Client mode :

Server mode :

somaxconn :

Severity

• Attack vector : "Local" because the attacker needs to be on the system where the Netty application is running.
• Attack complexity : "Low" because the attacker only need to create a massive file (regardless of its contents).
• Privileges required : "Low" because the attacker requires a user account to exploit the vulnerability.
• User intercation : "None" because the administrator don't need to accidentally click anywhere to trigger the vulnerability. Furthermore, the exploitation works with defaults windows/AD settings.
• Scope : "Unchanged" because only Netty is affected by the vulnerability.
• Confidentiality : "None" because no data is exposed through exploiting the vulnerability.
• Integrity : "None" because the explotation of the vulnerability does not allow editing, deleting or adding data elsewhere.
• Availability : "High" because the exploitation of this vulnerability crashes the entire java application.