Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Just recently, NodeJS announced about the high impact security vulnerability issue recently fixed and announced by nodeJS team.
This vulnerability has been fixed immediately across all lines (4.x, 6.x, 7.x, and 8.x) but the reason on how it occurred and what it is is a little ambiguous
What is the Constant Hashtable Seeds vulnerability, and what caused it?
HashTables fulfill the dream of constant time insertions and access. A HashTable is a group of linked lists, the linked-lists must be small in order for the performance to be good.
This attack happens when the attacker over saturates one linked-list inside the hashtable, resulting in huge access times, slowing the whole node process. thus the denying of service attack vulnerability.
NodeJS prevents attackers from abusing one linked-list inside the hashtable by randomizing the hash function algorithm as they introduce random seeds for the algorithm at the initialization time.
The bug was that the random seed was always constant (random but never changing across each version of node) as it is initialized during compiling of node code, the reason behind this is that the V8 engine takes a snapshot of the initialized context, and reuses it on the next boots, to make things faster. so the attacker can now know the algorithm and its seed, allowing the attacker to abuse the hashtable and oversaturate one linked list.
I wrote a blog post about the topic explaining the hashTables and the origins of the vulnerability in more details, NodeJS: Constant HashTables Seeds Vulnerability – Medium
