hacnho/protobuf-monitoredresourcemetadata-user-labels-dos-poc

Protocol Buffers MonitoredResourceMetadata user_labels materialization DoS PoC

This repository contains a benign security research PoC for a .pb artifact that drives repeated map-entry materialization during monitored_resource_pb2.MonitoredResourceMetadata.ParseFromString(...).

Files:

• control_one_user_label.pb
• malicious_user_labels_1200000.pb
• reproduce.py

Observed behavior:

• control artifact:
  • parses successfully with one user_labels entry
  • first_key_len = 15688877
• malicious artifact:
  • both files are 15,688,890 bytes
  • parses successfully with 1,200,000 user_labels entries
  • increases peak RSS by about 113408 kB in local clean-process replay

Tested runtime:

• protobuf==7.35.1
• Python: /usr/bin/python3

Public files:

• https://huggingface.co/hacnho/protobuf-monitoredresourcemetadata-user-labels-dos-poc/resolve/main/control_one_user_label.pb
• https://huggingface.co/hacnho/protobuf-monitoredresourcemetadata-user-labels-dos-poc/resolve/main/malicious_user_labels_1200000.pb
• https://huggingface.co/hacnho/protobuf-monitoredresourcemetadata-user-labels-dos-poc/resolve/main/reproduce.py
• repo sha: 590e8469f506b7e6d65ab0c22ff5429fc6fa2eae

Reproduction:

python3 reproduce.py

Latest replay snapshots:

• local replay:
  • vmhwm_delta_kb = 120276
  • elapsed_ratio = 16.28
• public replay:
  • vmhwm_delta_kb = 120244
  • elapsed_ratio = 18.04