Heap-use-after-free in jsmn_parse in fluent-bit
Summary
OSV-2022-281: Heap-use-after-free in jsmn_parse. Affects fluent-bit across 2 version ranges.
< 7e6e42d1c12644b6d5007b0415553e24761e7e59
>= af7ef37d6f0c61a79a8bd66f603273245198e069, < 7568fddddca799fc921e9db29c3f57d67d0fd85c
Fixed in 7568fddddca799fc921e9db29c3f57d67d0fd85c. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fluent Bit is an open-source and multi-platform log processor and forwarder. It allows you to collect logs from various sources, parse them, and send them to different destinations. It is widely used in applications and systems that require efficient log processing and forwarding. However, a vulnerability has been discovered in the jsmn_parse function of fluent-bit, which can lead to a heap-use-after-free condition.
Vulnerability Detail
The vulnerability in fluent-bit arises from a heap-use-after-free condition in the jsmn_parse function. This function is responsible for parsing JSON data, and the issue occurs when the function attempts to access a previously freed memory block. An attacker can exploit this vulnerability by crafting a specially crafted JSON payload, which, when processed by fluent-bit, triggers the use of the freed memory block. This can lead to various consequences, including crashes, information disclosure, or even remote code execution.
How To Fix
Minimum fixed version
7568fddddca799fc921e9db29c3f57d67d0fd85c
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating fluent-bit is not immediately feasible, a temporary workaround is to disable the processing of JSON data in fluent-bit. This can be achieved by modifying the configuration file to exclude JSON data sources or by using a different log processor until the update can be applied.
Conclusion
The heap-use-after-free vulnerability in jsmn_parse of fluent-bit can have serious consequences, including crashes and potential remote code execution. It is crucial to update fluent-bit to a version that includes the fix or apply the temporary workaround of disabling JSON data processing. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fluent-bit →
FAQ
Fluent Bit is an open-source log processor and forwarder used to collect, parse, and send logs from various sources to different destinations.
jsmn_parse is a function in fluent-bit responsible for parsing JSON data.
A heap-use-after-free vulnerability occurs when a program attempts to access memory that has already been freed. This can lead to crashes, information disclosure, or even remote code execution.
An attacker can exploit this vulnerability by crafting a specially crafted JSON payload that triggers the use of a freed memory block in fluent-bit.
Yes, this vulnerability has been fixed in fluent-bit versions 1.9.0 and later.
References
Related vulnerabilities
Recent vulnerabilities recorded for fluent-bit.
