Integer Overflow in Chunking Helper Causes Dispatching Issues

CVE-2024-27101

What is CVE-2024-27101?

SpiceDB, a database inspired by Google Zanzibar, is designed for managing security-critical application permissions. This vulnerability is triggered by an integer overflow occurring in the chunking helper, which may cause permission dispatching errors or system panic. The vulnerability impacts any SpiceDB cluster that utilizes a schema where a resource has more than 65,535 relationships for the same resource and subject type. The affected API methods include CheckPermission, BulkCheckPermission, and LookupSubjects. Users are urged to upgrade to version 1.29.2 or later to mitigate this issue.

References