PT-2023-9000 · Microsoft+2 · Azure Uamqp+2

Ericwolz · Published 2023-12-06 · Updated 2024-02-05 · CVE-2024-21646

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Azure uAMQP versions prior to 2024-01-01

Description The issue is related to an integer overflow or wraparound or memory safety issue in the Azure uAMQP library, which is a general-purpose C library for AMQP 1.0. This library is used by several clients to implement AMQP protocol communication. When clients using this library receive crafted binary type data, the issue can occur and may cause remote code execution.

Recommendations For Azure uAMQP versions prior to 2024-01-01, update to the release 2024-01-01 or later to patch the vulnerability. As a temporary workaround, consider restricting the reception of crafted binary type data to minimize the risk of exploitation.

Exploit

Fix

RCE

Integer Overflow

Code Injection

Weakness Enumeration

CWE-190

CWE-94

Related Identifiers

AZL-33284

AZL-34555

BDU:2024-02931

CVE-2024-21646

GHSA-J29M-P99G-7HPV

OPENSUSE-SU-2024:13643-1

OPENSUSE-SU-2024_0323-1

SUSE-SU-2024:0323-1

SUSE-SU-2024_0323-1

Affected Products

Azure Uamqp

Debian

Suse

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21646.json · Exploit
• https://github.com/Azure/azure-uamqp-c/commit/12ddb3a31a5a97f55b06fa5d74c59a1d84ad78fe · Patch
• https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-j29m-p99g-7hpv · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-21646 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-33284 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02931 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-21646 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21646 · Security Note
• https://osv.dev/vulnerability/AZL-34555 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0323-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21646 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-21646 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-21646 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-21646 · Vendor Advisory
• https://github.com/Azure/azure-uamqp-python/commit/c85efcd12c249999eb8a1064b7d4fd8c7715c780 · Note