CVE-2024-50608: treasuredata fluent_bit NULL Pointer Dereference

Vulnerability summary

CVE-2024-50608 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in treasuredata fluent_bit. EPSS estimates a 1.11% chance of exploitation in the next 30 days, higher than 65.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 18-02-2025
   PublishedVulnerability first disclosed.
2. 19-02-2025
   Last modifiedVulnerability information updated.

Description

An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_metrics_ng() at prom_rw_prot.c.

• CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.