go.etcd.io bbolt Index Out-of-Range Vulnerability in Bucket.Stats

A vulnerability exists in the go.etcd.io/bbolt package, specifically in the Bucket.Stats() method, which can lead to a panic due to an index-out-of-range error. This issue arises when the method encounters a branch page with zero elements, such as in cases of database corruption or partial writes. The method accesses branch page elements without verifying that the count is greater than zero, leading to an underflow and a crash. This vulnerability affects all versions of the package prior to the fix.

Impact

Exploiting this vulnerability causes a process to crash when Bucket.Stats() is called on a corrupted branch page, leading to an unrecoverable panic.

Remediation

Users can update to the latest version of go.etcd.io/bbolt, where this vulnerability has been fixed. The fix has been merged into the main branch and backported to versions 1.4 and 1.3.