DoS via unbounded recursive deserialization in geoprobe

[ben-dz]

Description

The LocationOffset.unmarshalHelper function recursively unmarshals reference chains without any depth limit. An attacker can craft a malicious UDP packet with NumReferences=255 pointing to deeply nested or circular reference structures, causing stack exhaustion and crashing the service.

Location

controlplane/telemetry/internal/geoprobe/offset.go:110-115

Impact

Denial of Service (DoS) - can crash the telemetry service by sending specially crafted UDP packets

Recommendation

1. Add a maximum depth constant (e.g., MaxReferenceDepth = 10)
2. Pass a depth counter through the recursive unmarshalHelper calls
3. Return an error when depth is exceeded
4. Validate that NumReferences matches the actual length of References after unmarshaling

References

From security review findings in docs/reviews-2901.md

[ben-dz]

Will be fixed in #2916