GHSA-852r-3wcv-pjx2: FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds read
FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, processsflowflowsample() in src/sflowplugin/sflowcollector.cpp passes the attacker-controlled sflowrawprotocolheadert.headersize to parserawpackettosimplepacketfull() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated headersize creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review.
Event History
Frequently Asked Questions
Which deployments are exposed?
FastNetMon versions 1.2.9 and earlier are affected when they process sFlow v5 UDP traffic. Systems not receiving such traffic are not exposed through this code path based on the available information.
Does an attacker need credentials or user interaction?
No. The issue can be triggered remotely by an unauthenticated attacker, and no user interaction is required.
Is a fixed release available?
No fixed release was available as of the review. The provided references include upstream commits, but the data does not identify a released version containing a fix.
What is the operational impact of a successful attack?
A crafted inflated header_size can cause an out-of-bounds read and crash the FastNetMon process. Parsed flow fields may also expose limited adjacent memory bytes.