CVE-2017-9790: Use after free in Apache Mesos
Summary
CVE-2017-9790: Use after free in Apache Mesos. Affects org.apache.mesos:mesos across 3 version ranges.
< 1.1.3
>= 1.2.0, < 1.2.2
>= 1.3.0, < 1.3.1
Fixed in 1.1.3, 1.2.2 or 1.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Mesos is an open-source cluster manager that provides efficient resource isolation and sharing across distributed applications. It allows users to run multiple frameworks on a shared pool of resources, enabling efficient utilization of computing resources. However, a vulnerability has been discovered in Apache Mesos versions before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev that can lead to a denial of service (DoS) attack on Mesos masters, rendering the Mesos-controlled cluster inoperable.
Vulnerability Detail
The vulnerability arises when handling a libprocess message wrapped in an HTTP request. If the request path is empty, the libprocess parser assumes that the request path always starts with '/', leading to a use-after-free issue. A malicious actor can exploit this vulnerability to cause a crash in libprocess, resulting in a DoS attack on Mesos masters. This can disrupt the functioning of the Mesos-controlled cluster and impact the availability of services running on it.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.1.31.1.3 -
>= 1.2.0, < 1.2.21.2.2 -
>= 1.3.0, < 1.3.11.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions of Apache Mesos.
Conclusion
The use-after-free vulnerability in Apache Mesos can be exploited by a malicious actor to cause a denial of service (DoS) attack on Mesos masters. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of Apache Mesos. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.mesos:mesos →
FAQ
Apache Mesos is an open-source cluster manager that provides efficient resource isolation and sharing across distributed applications.
This vulnerability can lead to a denial of service (DoS) attack on Mesos masters, rendering the Mesos-controlled cluster inoperable.
A malicious actor can exploit this vulnerability by sending an HTTP request with an empty path, causing a crash in libprocess and disrupting the functioning of the Mesos-controlled cluster.
Yes, it is recommended to upgrade to the fixed versions of Apache Mesos to address this vulnerability.
No, there is no known workaround for this vulnerability. Upgrading to the fixed versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.mesos:mesos.
