CVE-2024-23722 Null dereference in n/a

High 7.5 Published 26 Mar 2024 Updated 6 Aug 2024

An attacker can crash the Fluent Bit log processor by sending a malformed HTTP payload, causing a denial of service and preventing log delivery.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-23722?

CVE-2024-23722 is a high-severity vulnerability in n/a, published on 26 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.

Weakness: CWE-476

Which versions are affected by CVE-2024-23722?

1 open source package ship an affected version, including fluent-bit. It affects 1 product.

Package	Affected	Fixed in
`fluent-bit` Bitnami	From `2.1.8`	`2.2.2`

Products include Treasuredata Fluent Bit.

How do I fix CVE-2024-23722?

Upgrade fluent-bit to 2.2.2 or later.

Is CVE-2024-23722 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-23722 exists.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as AZL-37083, BIT-fluent-bit-2024-23722, GHSA-7x4x-j7vx-3p29.