CVE-2023-33657: Use After Free

Published Jun 8, 2023

Updated

A use-after-free vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nnimqttmsggetpublishproperty() in the file mqttmsg.c. This vulnerability is caused by improper data tracing, and an attacker could exploit it to cause a denial of service attack.

Affected Software

1 affected component

emqx Nanomq=0.17.2

Remediation

Patch Available

https://github.com/emqx/nanomq/pull/1187

Event History

Jun 8, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·01:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-33657?

CVE-2023-33657 has a high severity rating due to its potential to trigger denial of service attacks.

How do I fix CVE-2023-33657?

To fix CVE-2023-33657, it is recommended to upgrade to a patched version of NanoMQ beyond 0.17.2.

What causes CVE-2023-33657?

CVE-2023-33657 is caused by improper data tracing in the nni_mqtt_msg_get_publish_property() function in MQTT message handling.

Which versions of NanoMQ are affected by CVE-2023-33657?

CVE-2023-33657 affects NanoMQ version 0.17.2.

Can CVE-2023-33657 lead to data compromise?

While CVE-2023-33657 primarily leads to denial of service, it does not directly compromise data integrity or confidentiality.