F5-K000162608: Use After Free
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing include virtual commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or cause a worker process to terminate unexpectedly. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 37.1.0.137.0.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.71.30.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.24.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.16.05.14.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.11.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.7.0
Event History
Frequently Asked Questions
What conditions are needed for exploitation?
The affected NGINX instance must have asynchronous file I/O (AIO) enabled in a susceptible configuration and process an SSI page containing include virtual commands. No authentication or user interaction is required according to the supplied attack vector.
Who is exposed to code execution versus worker-process termination?
Memory corruption or an unexpected worker-process termination may occur when the vulnerable request path is triggered. Code execution is described for systems with ASLR disabled, or where an attacker can bypass ASLR.
Are all NGINX deployments affected by default?
The issue is conditional on AIO being enabled in certain configurations and on processing SSI content with include virtual commands. The supplied information does not establish that default configurations are affected.