CVE-2018-10184 Memory corruption in n/a

High 7.5 Published 9 May 2018 Updated 5 Aug 2024

A heap overflow in HAProxy's HTTP/2 frame handling allows remote attackers to cause a denial of service via crafted frames.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-10184?

CVE-2018-10184 is a high-severity memory corruption vulnerability in Redhat Enterprise Linux, published on 9 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in HAProxy before 1.8.8. The incoming H2 frame length was checked against the max_frame_size setting instead of being checked against the bufsize. The max_frame_size only applies to outgoing traffic and not to incoming, so if a large enough frame size is advertised in the SETTINGS frame, a wrapped frame will be defragmented into a temporary allocated buffer where the second fragment may overflow the heap by up to 16 kB. It is very unlikely that this can be exploited for code execution given that buffers are very short lived and their addresses not realistically predictable in production, but the likelihood of an immediate crash is absolutely certain.

Weakness: CWE-119

Which versions are affected by CVE-2018-10184?

It affects 2 products.

Linux distribution packages (6)

`haproxy` Red Hat:openshift:3.9::el7	All versions	`0:1.8.8-1.el7`
`haproxy-debuginfo` Red Hat:openshift:3.9::el7	All versions	`0:1.8.8-1.el7`
`haproxy18` Red Hat:openshift:3.9::el7	All versions	`0:1.8.8-1.el7`
`rh-haproxy18-haproxy` Red Hat:rhel_software_collections:3::el7	All versions	`0:1.8.4-2.el7`
`rh-haproxy18-haproxy-debuginfo` Red Hat:rhel_software_collections:3::el7	All versions	`0:1.8.4-2.el7`
`rh-haproxy18-haproxy-syspaths` Red Hat:rhel_software_collections:3::el7	All versions	`0:1.8.4-2.el7`

Products include Haproxy Haproxy, Redhat Enterprise Linux.

How do I fix CVE-2018-10184?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2018-10184 being exploited?

There is no known exploitation of CVE-2018-10184 in the wild and no public exploit code.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as CVE-2018-1119, DEBIAN-CVE-2018-10184, GHSA-v27h-hh5q-3p4q, RHBA-2018:1566, RHSA-2018:1372.