Impact

The DragonFly2 uses int and uint numeric types in its golang codebase. These types’ bit sizes are either 32 or 64 bits, depending on the hardware where the code is executed. Because of that, DragonFly2 components running on different architectures may behave differently. These discrepancies in behavior may lead to unexpected crashes of some components or incorrect data handling.
For example, the handlePeerSuccess method casts peer.Task.ContentLength variable to the int type. Schedulers running on different machines may behave differently, because of this behavior.

if len(data) != int(peer.Task.ContentLength.Load()) {
       peer.Log.Errorf("download tiny task length of data is %d, task content length
is %d", len(data), peer.Task.ContentLength.Load())
return
}

Patches

• Dragonfy v2.1.0 and above.

Workarounds

There are no effective workarounds, beyond upgrading.

References

A third party security audit was performed by Trail of Bits, you can see the full report.

If you have any questions or comments about this advisory, please email us at [email protected].