Segv on unknown address in flb_ra_translate - Vulnerability in fluent-bit
Summary
OSV-2022-288: Segv on unknown address in flb_ra_translate. Affects fluent-bit across 3 version ranges.
< 5d8d6bc46822a32e1c5a60b91cc59cecf0e63f10
>= 39b035b72761f3f4678bcce2cdb23f8b517a5665, < 80d028109d3a55792f3bcfcb799292891409bdab
< 60d4b2edd80c66ead1797c05f9294153d48129f7
Fixed in 80d028109d3a55792f3bcfcb799292891409bdab. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Fluent Bit is an open-source and multi-platform log processor and forwarder. It is designed to collect, parse, and route logs from various sources to different destinations. The package provides a flexible and efficient way to handle log data, making it a popular choice for log management in many applications. However, a vulnerability has been discovered in fluent-bit that can lead to a segmentation fault (segv) on an unknown address.
Vulnerability Detail
The vulnerability in fluent-bit, identified as OSV-2022-288, is triggered during the execution of the 'flb_ra_translate' function. This function is responsible for translating records in the 'record_ac_fuzzer.c' file. The exact cause of the segv is currently unknown. The impact of this vulnerability can result in a crash, causing the application to become unresponsive or terminate unexpectedly. It may also be possible for an attacker to exploit this vulnerability to execute arbitrary code or launch a denial-of-service attack.
How To Fix
Minimum fixed version
80d028109d3a55792f3bcfcb799292891409bdab
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As there is currently no known workaround for this vulnerability, it is crucial to update fluent-bit to a fixed version as soon as possible.
Conclusion
The vulnerability in fluent-bit can lead to a segmentation fault and potential exploitation by attackers. It is crucial to update fluent-bit to a fixed version to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fluent-bit →
FAQ
Fluent Bit is an open-source log processor and forwarder that collects, parses, and routes logs from various sources to different destinations.
The vulnerability can lead to a segmentation fault, causing the application to crash or become unresponsive. It may also be possible for an attacker to exploit this vulnerability to execute arbitrary code or launch a denial-of-service attack.
To fix this vulnerability, update fluent-bit to a version that includes the fix. Refer to the provided commit IDs for the fixed versions.
No, there is currently no known workaround for this vulnerability. Updating to a fixed version is the recommended solution.
You can find more information about this vulnerability in the OSS-Fuzz report: [link to the report].
References
Related vulnerabilities
Recent vulnerabilities recorded for fluent-bit.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
