PT-2023-12598 · Treasure Data · Treasure Data Fluent Bit

David Korczynski + 1 · Published 2023-04-11 · Updated 2024-03-06 · CVE-2021-46878

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Treasure Data Fluent Bit version 1.7.1

Description An issue was discovered in Treasure Data Fluent Bit, where erroneous parsing in flb pack msgpack to json format leads to a type confusion bug. This bug interprets whatever is on the stack as msgpack maps and arrays, leading to use-after-free. An attacker can craft a specially crafted file and trick the victim into opening it using the affected software, triggering use-after-free and executing arbitrary code on the target system.

Recommendations For Treasure Data Fluent Bit version 1.7.1, consider disabling the flb pack msgpack to json format function until a patch is available to prevent exploitation. Restrict access to potentially vulnerable files to minimize the risk of triggering the use-after-free bug. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

BIT-FLUENT-BIT-2021-46878

CVE-2021-46878

Affected Products

Treasure Data Fluent Bit

References · 7

• 🔥 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27742 · Exploit
• https://github.com/fluent/fluent-bit/pull/3115 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-46878 · Security Note
• https://osv.dev/vulnerability/BIT-fluent-bit-2021-46878 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46878 · Vendor Advisory
• https://t.me/cvenotify/48023 · Telegram Post
• https://t.me/cibsecurity/61915 · Telegram Post