Invalid-free vulnerability in reset_context of fluent-bit
Summary
OSV-2023-692: Invalid-free in reset_context. Affects fluent-bit across 3 version ranges.
< 2beca980f55714f669b6605f6b110e25522c1dbc
>= 3c7cfed0fbd446a55a7e7e5889b9a43147405c4d
>= 6f54e3d7d64bd6a03b5affea609bd285e3d7c1c2, < fe43ed120ce9c2612f75cca4424150c1b15690d5
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fluent Bit is an open-source and multi-platform log processor and forwarder. It allows users to collect logs from various sources, parse them, and send them to different destinations. The vulnerable component, reset_context, is responsible for resetting the context of Fluent Bit. This vulnerability allows an attacker to trigger an invalid-free condition, leading to a crash in the reset_context function.
Vulnerability Detail
The invalid-free vulnerability in reset_context of fluent-bit can be exploited by an attacker to cause a crash. The crash occurs due to an invalid memory deallocation, which can lead to a denial-of-service (DoS) condition. An attacker with the ability to send specially crafted input to the affected component can trigger this vulnerability. The crash can potentially disrupt the normal operation of Fluent Bit, impacting its availability and reliability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability at the moment. It is recommended to apply the official fix or update Fluent Bit to a patched version.
Conclusion
The invalid-free vulnerability in reset_context of fluent-bit can be exploited to cause a crash, potentially leading to a denial-of-service condition. Users are advised to update their installations to a version that includes the fix or apply the provided patch. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fluent-bit →
FAQ
Fluent Bit is an open-source log processor and forwarder that allows users to collect, parse, and send logs from various sources to different destinations.
This vulnerability can lead to a denial-of-service (DoS) condition by causing a crash in Fluent Bit. It may disrupt the normal operation of the software, impacting its availability and reliability.
An attacker with the ability to send specially crafted input to the affected component can trigger the invalid-free condition, leading to a crash in the reset_context function.
Yes, the Fluent Bit project has addressed this vulnerability in commit 3c7cfed0fbd446a55a7e7e5889b9a43147405c4d and commit 6f54e3d7d64bd6a03b5affea609bd285e3d7c1c2. Users should update their installations to a version that includes these commits or apply the relevant patch provided by the project.
There is no known workaround for this vulnerability at the moment. It is recommended to apply the official fix or update Fluent Bit to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for fluent-bit.
