GHSA-m7mp-rr3v-hmhr: NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS
NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe() in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16() while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curpos unchanged while topiccount continues to increase, allowing a malicious MQTT broker to hang a connecting MQTT 3.1.1 client, consume CPU and memory, and repeatedly deny service when automatic reconnection is enabled. The broker-side nmqunsubinfodecode path is not affected. This issue is fixed in version 0.24.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NanoMQto a version that resolves this vulnerability.Fixed in 0.24.14
Event History
Frequently Asked Questions
Which NanoMQ deployments are exposed to this issue?
The affected code is in the NanoMQ MQTT client decoder, so systems that connect as MQTT 3.1.1 clients to an untrusted or malicious broker are exposed. The broker-side nmq_unsubinfo_decode path is not affected.
What must an attacker control to trigger the denial of service?
An attacker needs to operate or control the MQTT broker that the NanoMQ client connects to and send a malformed UNSUBSCRIBE packet. The packet condition described is a zero-length topic followed by trailing data.
Does automatic reconnection worsen the impact?
Yes. When automatic reconnection is enabled, the malicious broker can repeatedly trigger the condition after reconnects, causing recurring denial of service and continued CPU and memory consumption.
What version resolves the issue?
The issue is fixed in NanoMQ version 0.24.14. Versions prior to 0.24.14 are affected.