Bug 2271642 (CVE-2024-23722)

Summary:	CVE-2024-23722 fluent-bit: NULL pointer dereference leads to server crash
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	lmaciasm10
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	fluent-bit 2.2.2	Doc Type:	---
Doc Text:	A NULL pointer dereference issue was found in Fluent Bit. HTTP requests are not properly verified before being processed. If an HTTP request is made without a '=' being present in the body, the application is unable to parse the request, and creates an array full of NULL pointers. This causes a NULL pointer dereference later when the application attempts to load the parsed data, leading to an application crash. An attacker can use this vulnerability to cause a denial of service on any Fluent Bit server that is configured to receive HTTP requests. As fluent-bit is a log router crashing the server can prevent logs from being delivered to the appropriate locations.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mauro Matteo Cascella 2024-03-26 16:57:09 UTC

In fluent-bit versions 2.1.8 through 2.2.1 HTTP requests are not properly verified before being processed. If an HTTP request is made without a ‘=’ being present in the body, the application is unable to parse the request, and creates an array full of null pointers. This causes a null pointer dereference later when the application attempts to load the parsed data, leading to an application crash. An attacker can use this vulnerability to cause a DoS on any Fluent Bit server that is configured to receive HTTP requests. As fluent-bit is a log router crashing the server can prevent logs from being delivered to the appropriate locations and create a visibility gap that attackers can further exploit. We were unable to find any RCE vulnerabilities stemming from this issue. A CVE, CVE-2024–23722, was created for this vulnerability.

Reference:
https://medium.com/@adurands82/fluent-bit-dos-vulnerability-cve-2024-23722-4e3e74af9d00

Comment 1 leoswaldo 2024-04-23 18:00:59 UTC

Mauro, I assume on v2.2.2 it ahs been already fixe. I am landing v2.2.2 for most of the branches so we should be good by end of last week, Could you just confirm if this documented in a issue on github fluent-bit repo ?