Critical Pointer Overflow Vulnerability in ZeroMQ Package
Summary
ALPINE-CVE-2019-6250: A pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.1. Affects zeromq versions < 4.3.1-r0. Fixed in 4.3.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ZeroMQ is a high-performance asynchronous messaging library aimed at use in scalable distributed or concurrent applications. It provides a message queue, but unlike traditional message brokers, it can be used in a variety of messaging patterns such as publish-subscribe, request-reply, and more. The library is widely used in various applications for its efficiency and flexibility. However, it has been found to be vulnerable to a pointer overflow issue that can lead to severe security risks.
Vulnerability Detail
A pointer overflow vulnerability exists in ZeroMQ libzmq (also known as 0MQ) versions 4.2.x and 4.3.x prior to 4.3.1. This vulnerability arises from an integer overflow in the v2_decoder.cpp file, specifically in the zmq::v2_decoder_t::size_ready function. An authenticated attacker can exploit this flaw to overwrite an arbitrary amount of bytes beyond the bounds of a buffer, potentially allowing them to execute arbitrary code on the target system. This vulnerability is particularly dangerous as it allows attackers to inject OS commands into a data structure located immediately after the problematic buffer, bypassing traditional buffer-overflow exploitation techniques.
How To Fix
Minimum fixed version
4.3.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade zeromqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing network-level controls to restrict access to the ZeroMQ service, thereby limiting the potential for exploitation until the package can be updated.
Conclusion
In summary, the pointer overflow vulnerability in ZeroMQ poses a significant risk to systems using affected versions of the library. It is essential to update to the patched version 4.3.1-r0 or later to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert, which can provide real-time alerts for open-source vulnerabilities.
See every vulnerability recorded for zeromq →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
The affected versions are ZeroMQ libzmq 4.2.x and 4.3.x prior to 4.3.1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to arbitrary code execution, allowing attackers to gain control over the affected system.
Yes, you can implement network-level controls to restrict access to the ZeroMQ service as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for zeromq.
