CVE-2017-2922 Use after free in Mongoose
Remote attackers can achieve code execution in Cesanta Mongoose by sending a crafted WebSocket packet that triggers a use-after-free vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-2922?
CVE-2017-2922 is a critical use after free vulnerability in Cesanta Mongoose, published on 7 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can cause a buffer to be allocated while leaving stale pointers which leads to a use-after-free vulnerability which can be exploited to achieve remote code execution. An attacker needs to send a specially crafted websocket packet over the network to trigger this vulnerability.
Weakness: CWE-416
Which versions are affected by CVE-2017-2922?
It affects 1 product.
Products include Cesanta Mongoose.
How do I fix CVE-2017-2922?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2017-2922 being exploited?
There is no known exploitation of CVE-2017-2922 in the wild and no public exploit code.
Other vulnerabilities in Cesanta Mongoose
Sources
Also known as DEBIAN-CVE-2017-2922, GHSA-g5qg-r8q8-9m72.