CVE-2024-1023: Eclipse Vert.x memory leak in io.vertx:vertx-core
Summary
CVE-2024-1023: Eclipse Vert.x memory leak. Affects io.vertx:vertx-core across 2 version ranges.
>= 4.4.5, < 4.4.7
>= 4.5.0, < 4.5.2
Fixed in 4.4.7 or 4.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The io.vertx:vertx-core package is a part of the Eclipse Vert.x toolkit, which is a reactive toolkit for building distributed and event-driven applications on the Java Virtual Machine (JVM). It provides a set of APIs for building high-performance, scalable, and resilient applications. The vulnerability in this package is related to a memory leak caused by the usage of Netty FastThreadLocal data structures. This leak occurs when the Vert.x HTTP client establishes connections to different hosts, and it can be accelerated by connecting to arbitrary internet addresses. This vulnerability can be exploited by an attacker with intimate runtime knowledge.
Vulnerability Detail
The vulnerability in the io.vertx:vertx-core package results in a memory leak due to the usage of Netty FastThreadLocal data structures. When the Vert.x HTTP client establishes connections to different hosts, the memory leak is triggered. This leak can be accelerated by connecting to arbitrary internet addresses, making it a potential attack vector. The memory leak can be exploited by an attacker with intimate runtime knowledge, allowing them to potentially exhaust system resources and disrupt the normal functioning of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.4.5, < 4.4.74.4.7 -
>= 4.5.0, < 4.5.24.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade the io.vertx:vertx-core package to the fixed version.
Conclusion
In conclusion, the io.vertx:vertx-core package is vulnerable to a memory leak issue when using Netty FastThreadLocal data structures. This vulnerability can be exploited by an attacker with intimate runtime knowledge, potentially leading to the exhaustion of system resources. It is recommended to upgrade the package to version 4.5.2 or later to fix this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for io.vertx:vertx-core →
FAQ
Eclipse Vert.x is a reactive toolkit for building distributed and event-driven applications on the JVM. It provides APIs for building high-performance, scalable, and resilient applications.
The vulnerability can result in a memory leak, potentially leading to the exhaustion of system resources and disruption of the application's normal functioning.
An attacker with intimate runtime knowledge can exploit this vulnerability by triggering the memory leak through the Vert.x HTTP client's connection to different hosts. They can further accelerate the leak by connecting to arbitrary internet addresses.
Yes, the fix for this vulnerability is available in version 4.5.2 of the io.vertx:vertx-core package. Upgrading to this version will resolve the memory leak issue.
There are no specific workarounds mentioned for this vulnerability. The recommended approach is to upgrade the io.vertx:vertx-core package to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.vertx:vertx-core.
