CVE-2021-31618: NULL pointer dereference on specially crafted HTTP/2 request
A null pointer de-reference was found in the way httpd handled specially crafted HTTP/2 request. A remote attacker could use this flaw to crash the httpd child process, causing temporary denial of service.
Other sources
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected.
This rejection response was not fully initialized in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a footer. This led to a NULL pointer dereference on initialized memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server.
References:
https://httpd.apache.org/security/vulnerabilities24.html
Upstream patch:
https://github.com/apache/httpd/commit/f990e5ecad40b100a8a5c7c1033c46044a9cb244 http://svn.apache.org/viewvc?view=revision&revision=1889759
— Red Hat
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected modhttp2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-31618?
CVE-2021-31618 is a null pointer de-reference vulnerability found in the Apache HTTP Server protocol handler for the HTTP/2 protocol.
What is the severity of CVE-2021-31618?
The severity of CVE-2021-31618 is high, with a CVSS severity score of 7.5.
Which software versions are affected by CVE-2021-31618?
The Apache HTTP Server versions 2.4.47 and 2.4.48, as well as some specific versions of Fedora, Debian, Oracle Enterprise Manager Ops Center, Oracle Instantis Enterprisetrack, and Oracle ZFS Storage Appliance Kit are affected.
How does CVE-2021-31618 impact the Apache HTTP Server?
CVE-2021-31618 allows an attacker to exploit a null pointer de-reference vulnerability, potentially causing a denial-of-service condition by crashing the server process.
How can I mitigate CVE-2021-31618?
To mitigate CVE-2021-31618, it is recommended to upgrade to Apache HTTP Server version 2.4.49 or apply the necessary patches provided by the distribution vendor.