CVE-2024-50609

Published Feb 18, 2025

Last updated 9 days ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2024-50609 is a vulnerability found in Fluent Bit version 3.1.9. Specifically, it affects the OpenTelemetry input plugin when it's actively listening on a network port. An attacker can exploit this vulnerability by sending a specially crafted packet with a "Content-Length" header set to zero. This action can cause a null pointer dereference within the `cfl_sds_len` function, leading to a server crash and a denial-of-service condition. The root cause lies in the improper handling of the "Content-Length" header value when it's set to 0. This vulnerability allows a remote attacker with access to the OpenTelemetry plugin's listening port to perform a denial-of-service attack. The attack can be executed by sending a simple HTTP POST request with the malicious "Content-Length" header using a tool like cURL. The function `process_payload_traces_proto_ng()` within the `opentelemetry_prot.c` file is implicated in this vulnerability.

Description: An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_traces_proto_ng() at opentelemetry_prot.c.
Source: cve@mitre.org
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-476

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References