Description

Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking, causing the server to allocate one CacheItem per missing packet ID gap, exhausting available host memory and propagating an uncaught std::bad_alloc exception to std::terminate().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T13:18:21.947Z",
  "pubdate": "2026-08-06T13:18:21.947Z",
  "executiveSummary": "An unbounded memory allocation vulnerability exists in Sonic 3 A.I.R. before commit 2492d18, specifically within the ReceivedPacketCache::enqueuePacket() function.\nThis vulnerability allows unauthenticated remote attackers to cause a denial of service by crashing the server process.\nThe flaw stems from the direct reading of the mUniquePacketID field from the UDP wire-format packet header without performing proper bounds checking.\nWhen an attacker transmits a crafted UDP packet with the mUniquePacketID set to the maximum uint32 value, the server attempts to allocate one CacheItem object for every missing packet ID gap leading up to that maximum value.\nThis behavior rapidly exhausts the available host memory of the system running the server process.\nUpon exhausting memory, the application throws an uncaught std::bad_alloc exception that propagates to std::terminate(), resulting in an immediate and unrecoverable server crash.\nThe attack vector is network-based, requires no user interaction, and can be successfully executed by any unauthenticated remote attacker capable of sending UDP packets to the target server.\nThe risk implication is critical for availability, as remote actors can repeatedly disrupt service availability without holding valid credentials or administrative privileges.",
  "technicalDetails": "The root cause of the vulnerability resides in the packet ingestion logic of Sonic 3 A.I.R., specifically inside the ReceivedPacketCache::enqueuePacket() function.\nThe vulnerable component is responsible for caching incoming UDP packets and tracking sequence gaps using unique packet identifiers.\nThe affected versions include Sonic 3 A.I.R. builds prior to commit 2492d18.\nDuring normal packet processing, the network stack receives a UDP packet and parses the wire-format header to extract the mUniquePacketID field.\nDue to the absence of rigorous bounds checking or validation logic on this header field, the application trusts the supplied value implicitly.\nAn unauthenticated remote attacker exploits this condition by generating a malicious UDP payload where mUniquePacketID is manipulated to the maximum possible uint32 value.\nUpon receiving this crafted packet, the ReceivedPacketCache::enqueuePacket() function calculates the difference between the current packet ID and previously tracked IDs to identify missing packet gaps.\nBecause the attacker-supplied ID is set to the maximum uint32 value, the internal tracking mechanism attempts to provision a separate CacheItem instance for every single integer value bridging the perceived gap.\nThis triggers a massive and uncontrolled dynamic memory allocation loop, rapidly consuming all available random access memory (RAM) on the host operating system.\nAs the host memory allocation routines fail to satisfy the excessive memory request, the C++ runtime throws a std::bad_alloc exception.\nBecause the application lacks local try-catch exception handling around this critical allocation path, the uncaught exception propagates directly to std::terminate(), forcing an abrupt termination of the server process.\nThe network exposure is direct via UDP, requiring no authentication or specific user privileges to trigger the vulnerability."
}