Critical NULL Pointer Dereference in Netdata Package - CVE-2024-23722
Summary
UBUNTU-CVE-2024-23722: In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. Affects netdata versions 1.42.1-1 – 1.43.2-1build2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netdata is a real-time performance monitoring tool that provides insights into system metrics, applications, and services. It is widely used for its ability to visualize data and alert users about performance issues. The package includes various components such as netdata-core, netdata-web, and plugins for enhanced functionality. However, a vulnerability has been identified that can lead to system crashes under specific conditions.
Vulnerability Detail
In Fluent Bit versions 2.1.8 through 2.2.1, a NULL pointer dereference can occur when an invalid HTTP payload with the content type of x-www-form-urlencoded is processed. This vulnerability can cause the application to crash and not restart, potentially leading to a loss of log delivery and monitoring capabilities. The issue arises from improper handling of certain HTTP requests, making it critical for users to address it promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to ensure that only valid HTTP payloads are processed. This can help prevent the application from crashing while you work on applying the patch.
Conclusion
CVE-2024-23722 represents a significant risk for users of the Netdata package, as it can lead to application crashes and loss of critical monitoring functionality. It is essential to update to the latest version to mitigate this vulnerability effectively.
See every vulnerability recorded for netdata →
FAQ
CVE-2024-23722 is a vulnerability in the Netdata package that can lead to a NULL pointer dereference, causing the application to crash.
The vulnerability affects Netdata version 1.43.2-1build2 and Fluent Bit versions 2.1.8 through 2.2.1.
If exploited, this vulnerability can result in system crashes and loss of log delivery, impacting monitoring and alerting capabilities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2024-23722 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for netdata.
