Saint GarlicRust, the Clove That Bleeds Memory

Patron of anonymous networks, onion and garlic routing, and length fields checked too late.

Life

On 4 December 2017 Eyal Itkin disclosed a flaw found through Monero's bug bounty programme: the C++ I2P routers, i2pd and Kovri, used the length field of garlic routing cloves before validating it. Any node on the network could thus make a router hand back chunks of its memory, session keys included, Heartbleed-style and without crashing anything.

Prayer

O Saint GarlicRust, who draws secrets rather than aroma from garlic, let our parsers check lengths before they use them. Amen.

How to celebrate

Celebrated by upgrading i2pd to 2.17 and eating garlic bread, which at least keeps the vampires away.

Garlic keeps off vampires, not memory readers.