Security: Unbounded memory allocation in gNOI OS Install RPC (Resource Exhaustion)

[kazisabu]

Description

A vulnerability in the ReceiveOS function within gnoi/os/server.go allows for uncontrolled memory consumption. The server fails to enforce a maximum size limit on the bytes.Buffer when receiving TransferContent messages.

Impact

An authenticated remote attacker can stream an unlimited amount of data, causing the server to allocate memory until it triggers an Out of Memory (OOM) event, resulting in a Denial of Service (DoS). This has been validated by the Google VRP team (Issue #513177194).

Steps to Reproduce

1. Authenticate to the gNOI endpoint.
2. Initiate an Install RPC.
3. Send continuous TransferContent chunks without sending a TransferEnd.
4. Observe memory usage increasing until process termination.

Proposed Fix

I have submitted a Pull Request (#404) to address this by implementing a size cap on the buffer.