PT-2018-9737 · Haproxy+1 · Haproxy+1
Published
2018-05-09
·
Updated
2018-06-26
·
CVE-2018-10184
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
HAProxy versions prior to 1.8.8
Description:
A problem was discovered where the incoming H2 frame length was checked against the
max frame size setting instead of the bufsize. Since max frame size only applies to outgoing traffic, a large enough frame size advertised in the SETTINGS frame can cause a wrapped frame to be defragmented into a temporary allocated buffer, potentially overflowing the heap by up to 16 kB. While it is unlikely that this can be exploited for code execution due to the short-lived nature of buffers and their unpredictable addresses in production, the possibility of an immediate crash is certain.Recommendations:
For versions prior to 1.8.8, update to version 1.8.8 or later to resolve the issue. As a temporary workaround, consider restricting the
max frame size setting to prevent large frame sizes from being advertised in the SETTINGS frame. Additionally, monitor system resources for signs of unexpected crashes and be prepared to restart services as needed.Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Haproxy