Dragonfly incorrectly handles a task structure’s usedTraffic field

Root

Cause

The vulnerability lies in the processPieceFromSource method in Dragonfly's P2P file distribution system. The method writes pieces of data to storage and updates a Task structure. However, an uninitialized variable n is used as a guard for the AddTraffic method call instead of result.Size. This means the usedTraffic field is never updated during task processing [1][4].

Exploitation

No authentication is required for exploitation; any task processed by a peer triggers the bug. The attack surface is the peer-to-peer network itself—any peer that receives a task in a distributed environment will experience the flaw. The uninitialized variable leads to AddTraffic being called with n (which may be zero or undefined), so traffic is not properly accounted [4].

Impact

Because usedTraffic metadata is not updated, the rate-limiting mechanism that relies on it becomes ineffective. An attacker can cause a peer's traffic to be unrestricted, leading to resource exhaustion and a denial-of-service condition for that peer [1].

Mitigation

The issue is fixed in Dragonfly version 2.1.0. There are no workarounds; upgrading is the only solution [4].