Heap-double-free vulnerability in fluent-bit
Summary
OSV-2022-284: Heap-double-free in read_config. Affects fluent-bit across 2 version ranges.
< 5375fb219ca8aa70ecce8136621016a51c0b37ba
>= cee783e53b96e445983a667ba51da087df14e472, < 82d1819c655d2a74acc0a0cf7643430aa0da7d4b
Fixed in 82d1819c655d2a74acc0a0cf7643430aa0da7d4b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fluent Bit is an open-source and multi-platform log processor and forwarder. It allows you to collect logs from various sources, parse them, and send them to different destinations. The package is widely used in applications and systems that require efficient log management and analysis. However, a vulnerability has been discovered in the 'read_config' function of Fluent Bit, which can lead to a heap-double-free crash.
Vulnerability Detail
The vulnerability in Fluent Bit's 'read_config' function is categorized as a heap-double-free. This type of vulnerability occurs when a program attempts to free the same memory address twice, leading to memory corruption and potential crashes. In this case, the crash state occurs in the 'read_config' function, specifically in the 'read_glob' and 'read_config' sub-functions. The vulnerability has been reported through OSS-Fuzz, and more details can be found in the provided link. If exploited, this vulnerability can result in denial-of-service (DoS) attacks or potentially allow an attacker to execute arbitrary code.
How To Fix
Minimum fixed version
82d1819c655d2a74acc0a0cf7643430aa0da7d4b
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if updating to the latest version is not immediately feasible, you can mitigate the risk by avoiding the use of the 'read_config' function in your application or system. By bypassing this function, you can prevent the trigger of the heap-double-free vulnerability. However, this workaround should be considered temporary, and it is strongly advised to update to the fixed version as soon as possible.
Conclusion
In conclusion, Fluent Bit is affected by a heap-double-free vulnerability in the 'read_config' function. This vulnerability can lead to crashes, denial-of-service attacks, or potential code execution. It is crucial to update to the latest version of Fluent Bit to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fluent-bit →
FAQ
Fluent Bit is an open-source log processor and forwarder used for collecting, parsing, and forwarding logs from various sources.
A heap-double-free vulnerability occurs when a program attempts to free the same memory address twice, leading to memory corruption and potential crashes.
If exploited, this vulnerability can result in denial-of-service (DoS) attacks or potentially allow an attacker to execute arbitrary code.
To fix this vulnerability, update Fluent Bit to the latest version, which includes the necessary patches to address the heap-double-free issue.
As a temporary workaround, you can avoid using the 'read_config' function in your application or system to mitigate the risk. However, updating to the fixed version is strongly recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for fluent-bit.
