REDHAT-BUG-2502868: High severity rsyslog rsyslogd vulnerability
A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd. The issue is not active in a default installation. Exploitation requires all of the following:
imptcp is explicitly loaded. An imptcp listener uses the non-default framing.delimiter.regex mode. An attacker can establish a TCP connection to that listener.
A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.
Affected Software
Event History
Frequently Asked Questions
Which rsyslog deployments are exposed?
Default installations are not affected. Exposure requires that the optional imptcp module is explicitly loaded and that an imptcp listener is configured with the non-default framing.delimiter.regex mode.
What access does an attacker need, and what is the impact?
An unauthenticated attacker must be able to establish a TCP connection to the affected imptcp listener and send a crafted input sequence during oversize-frame recovery. The documented impact is termination of rsyslogd; no code execution, privilege escalation, confidentiality impact, or integrity impact has been identified.
What mitigation is available before patching?
If immediate patching is not possible, avoid using framing.delimiter.regex on imptcp listeners or disable the affected imptcp listener where operationally feasible. imtcp and the default imptcp framing modes are not affected.