Heap Buffer Overflow in Rsyslog
Summary
CVE-2022-24903: Rsyslog is a rocket-fast system for log processing. Affects rsyslog across 2 version ranges.
< 8.2004.0-r2
< f211042ecbb472f9d8beb4678a65d272b6f07705
Fixed in 8.2004.0-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rsyslog is a high-performance log processing system used for receiving, processing, and forwarding log messages. It provides modules for TCP syslog reception, including modules for regular syslog message reception and diagnostics. Octet-counted framing is a framing mode enabled by default on receivers, although it is relatively uncommon. This vulnerability affects the octet-counted framing mode in the modules imtcp, imptcp, imgssapi, and imhttp. The vulnerability allows for a potential heap buffer overflow when processing log messages with octet-counted framing.
Vulnerability Detail
The vulnerability occurs when the octet count is read. While there is a check for the maximum number of octets, digits are written to a heap buffer even when the octet count exceeds the maximum. This can lead to a heap buffer overflow, resulting in a segfault or other malfunctions. Although remote code execution is unlikely, there is a slight chance for experts to exploit the vulnerability. However, once the sequence of digits stops, no additional characters can be added to the buffer, making remote exploits highly complex or impossible. The risk is considerably lower if best practices are followed, such as not directly exposing the affected modules to the public and disabling octet-counted framing if not needed.
How To Fix
Minimum fixed version
8.2004.0-r2
This is the first release that contains the fix.
sudo apk add --upgrade rsyslogTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately possible, users can mitigate the vulnerability by disabling octet-counted framing for the affected modules (imtcp, imptcp, imgssapi, and imhttp). This can be done by modifying the configuration file of Rsyslog and setting the appropriate configuration option to disable octet-counted framing. For example, in the configuration file /etc/rsyslog.conf, the following lines can be added:
module(load="imtcp")
input(type="imtcp" port="514" octet-counted-framing="off")
After making the changes, restart the Rsyslog service for the configuration to take effect.
Conclusion
The heap buffer overflow vulnerability in Rsyslog's octet-counted framing mode can lead to malfunctions or a segfault. While remote code execution is unlikely, it is recommended to update the affected package to a fixed version or disable octet-counted framing for the affected modules. Following best practices and keeping the software up to date can help mitigate the risk associated with this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rsyslog →
FAQ
Rsyslog is a high-performance log processing system used for receiving, processing, and forwarding log messages. It provides various modules for different log reception methods and supports advanced features for log management and analysis.
Octet-counted framing is a framing mode used in syslog message reception. It involves prefixing each syslog message with the number of octets in the message. This allows for more efficient parsing and processing of syslog messages.
The vulnerability occurs when processing log messages with octet-counted framing. When the octet count is read, digits are written to a heap buffer even when the count exceeds the maximum. This can lead to a heap buffer overflow, resulting in a segfault or other malfunctions.
While remote code execution is unlikely, there is a slight chance for experts to exploit the vulnerability. However, once the sequence of digits stops, no additional characters can be added to the buffer, making remote exploits highly complex or impossible.
The vulnerability can be mitigated by following best practices, such as not directly exposing the affected modules to the public and disabling octet-counted framing if not needed. Users can also update the affected package to a version that includes the fix.
Related vulnerabilities
Recent vulnerabilities recorded for rsyslog.
