REDHAT-BUG-2519497: Medium severity cockpit-ws vulnerability
A flaw was found in cockpit-ws. The sendloginhtml() function in src/ws/cockpithandlers.c reads the CockpitLang cookie via cockpitwebserverparsecookie(), which returns a heap-allocated string (via guriunescapesegment, transfer-full ownership). On this code path, the function's only cleanup call is gstrfreev(languages), but languages remains NULL when the value came from the cookie rather than the Accept-Language header, so the allocated 'language' string is never freed. Every unauthenticated GET request to the login page carrying a CockpitLang cookie leaks one heap allocation sized by the (attacker-controlled) decoded cookie value, up to Cockpit's ~8192-byte request-size cap. Sustained requests grow the shared cockpit-ws process's memory without bound, eventually causing it to be OOM-killed and disrupting all users of that instance, not just the attacker.
Candidate upstream fix (Martin Vollmer): if (languages) gstrfreev (languages); else gfree (language);
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any shared cockpit-ws instance that serves its login page is exposed to denial of service if it receives sustained unauthenticated GET requests carrying a CockpitLang cookie. Memory growth affects the shared cockpit-ws process and can disrupt all users of that instance.
What does an attacker need to exploit it?
An attacker only needs to send unauthenticated GET requests to the login page with a CockpitLang cookie. The decoded cookie value controls the size of each leaked allocation, subject to an approximately 8192-byte request-size cap.
What happens if the issue is exploited repeatedly?
Each qualifying request leaks one heap allocation. Sustained requests can grow memory without bound until the cockpit-ws process is OOM-killed.
What can be done if a fix cannot be applied immediately?
The supplied data identifies the triggering condition as unauthenticated login-page GET requests containing a CockpitLang cookie. Restricting or filtering such requests would address that trigger, although no specific supported mitigation is provided.
How can administrators identify likely exploitation?
Look for repeated unauthenticated GET requests to the login page that include a CockpitLang cookie, together with persistent growth in the shared cockpit-ws process memory or an OOM kill of that process.