Heap-buffer-overflow in add_compile_string in fluent-bit
Summary
OSV-2022-289: Heap-buffer-overflow in add_compile_string. Affects fluent-bit across 2 version ranges.
< 3c13edab76389a7412deef12ac61a25b85f00c39
>= e59f16b1168fca4046fff219ba9ae4e20dee6610, < 9cc2ff55a146b2b3e8c321a87920c0d39a2b2ba6
Fixed in 9cc2ff55a146b2b3e8c321a87920c0d39a2b2ba6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fluent Bit is an open-source and multi-platform log processor and forwarder that allows you to collect data from different sources, unify it, and send it to multiple destinations. It is widely used in various applications and systems for log management and analysis. However, a vulnerability has been discovered in the add_compile_string function of Fluent Bit, which can lead to a heap-buffer-overflow read of 4 bytes.
Vulnerability Detail
The vulnerability in the add_compile_string function of Fluent Bit can be exploited to cause a heap-buffer-overflow read of 4 bytes. This can potentially result in a crash or allow an attacker to execute arbitrary code, leading to a breach of the system's security. The vulnerability was reported through the OSS-Fuzz project and has been assigned the identifier OSV-2022-289. The affected version ranges and the fixed versions can be found in the provided OSS-Fuzz report.
How To Fix
Minimum fixed version
9cc2ff55a146b2b3e8c321a87920c0d39a2b2ba6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advised to avoid using the add_compile_string function until the vulnerability is fixed. Developers can consider using alternative functions or approaches to achieve the desired functionality without exposing the system to the vulnerability.
Conclusion
The add_compile_string vulnerability in Fluent Bit can potentially lead to a heap-buffer-overflow read of 4 bytes, which can result in crashes or arbitrary code execution. It is crucial to update to the fixed versions mentioned in the OSS-Fuzz report to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fluent-bit →
FAQ
Fluent Bit is an open-source log processor and forwarder used for collecting and managing log data from various sources.
A heap-buffer-overflow is a type of memory vulnerability where data is written beyond the allocated buffer, potentially leading to crashes or security breaches.
The add_compile_string vulnerability can be exploited by providing malicious input that triggers a heap-buffer-overflow read of 4 bytes, potentially leading to a crash or arbitrary code execution.
Yes, the add_compile_string vulnerability has been fixed in the versions mentioned in the provided OSS-Fuzz report. It is recommended to update to the fixed versions to mitigate the vulnerability.
Yes, as a temporary workaround, it is advised to avoid using the add_compile_string function until the vulnerability is fixed. Developers can explore alternative functions or approaches to achieve the desired functionality without exposing the system to the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for fluent-bit.
