PT-2023-24436 · Nanomq · Nanomq

Zuoyuanp · CVE-2023-33657 · Published 2023-06-08 · Updated 2025-01-06

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NanoMQ version 0.17.2

Description A use-after-free issue exists due to improper data tracing. This can be triggered by calling the function nni mqtt msg get publish property() in the file mqtt msg.c, potentially allowing an attacker to cause a denial of service attack.

Recommendations For NanoMQ version 0.17.2, consider disabling the nni mqtt msg get publish property() function as a temporary workaround until a patch is available.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2023-33657

Affected Products

Nanomq

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33657.json · Exploit
• 🔥 https://github.com/emqx/nanomq/issues/1165#issue-1668648319 · Exploit
• https://github.com/emqx/nanomq/pull/1187 · Patch
• https://osv.dev/vulnerability/CVE-2023-33657 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33657 · Security Note
• https://github.com/emqx/nanomq · Note
• https://t.me/cibsecurity/65068 · Telegram Post
• https://t.me/cvenotify/106472 · Telegram Post