uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support an arbitrary depth of parameter nesting for strict blocking, which allows crafted web sites to cause a denial of service (unbounded recursion that can trigger memory consumption and a loss of all blocking functionality).
Weakness
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Nmatrix | Sciruby | * | 4.4.9 (excluding) |
| Ublock_origin | Ublockorigin | * | 1.36.2 (excluding) |
| Umatrix | Umatrix_project | * | 1.4.2 (excluding) |
| Ublock-origin | Ubuntu | bionic | * |
| Ublock-origin | Ubuntu | focal | * |
| Ublock-origin | Ubuntu | hirsute | * |
| Ublock-origin | Ubuntu | impish | * |
| Ublock-origin | Ubuntu | kinetic | * |
| Ublock-origin | Ubuntu | lunar | * |
| Ublock-origin | Ubuntu | mantic | * |
| Ublock-origin | Ubuntu | trusty | * |
| Ublock-origin | Ubuntu | xenial | * |
| Umatrix | Ubuntu | focal | * |
| Umatrix | Ubuntu | hirsute | * |
| Umatrix | Ubuntu | impish | * |
| Umatrix | Ubuntu | kinetic | * |
| Umatrix | Ubuntu | lunar | * |
| Umatrix | Ubuntu | trusty | * |
| Umatrix | Ubuntu | xenial | * |
Potential Mitigations
Related Attack Patterns
References
- https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc
- https://lists.debian.org/debian-lts-announce/2022/06/msg00024.html
- https://news.ycombinator.com/item?id=27833752
- https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc
- https://lists.debian.org/debian-lts-announce/2022/06/msg00024.html
- https://news.ycombinator.com/item?id=27833752