PT-2018-9737 · Haproxy+1 · Haproxy+1

Published

2018-05-09

·

Updated

2018-06-26

·

CVE-2018-10184

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions: HAProxy versions prior to 1.8.8
Description: A problem was discovered where the incoming H2 frame length was checked against the max frame size setting instead of the bufsize. Since max frame size only applies to outgoing traffic, a large enough frame size advertised in the SETTINGS frame can cause a wrapped frame to be defragmented into a temporary allocated buffer, potentially overflowing the heap by up to 16 kB. While it is unlikely that this can be exploited for code execution due to the short-lived nature of buffers and their unpredictable addresses in production, the possibility of an immediate crash is certain.
Recommendations: For versions prior to 1.8.8, update to version 1.8.8 or later to resolve the issue. As a temporary workaround, consider restricting the max frame size setting to prevent large frame sizes from being advertised in the SETTINGS frame. Additionally, monitor system resources for signs of unexpected crashes and be prepared to restart services as needed.

Fix

Buffer Overflow

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2018-1942
CVE-2018-10184
RHSA-2018:1372

Affected Products

Alt Linux
Haproxy