CVE-2024-22857 in Zlog
Summary
by MITRE • 03/07/2024
Heap based buffer flow in zlog v1.1.0 to v1.2.17 in zlog_rule_new().The size of record_name is MAXLEN_PATH(1024) + 1 but file_path may have data upto MAXLEN_CFG_LINE(MAXLEN_PATH*4) + 1. So a check was missing in zlog_rule_new() while copying the record_name from file_path + 1 which caused the buffer overflow. An attacker can exploit this vulnerability to overwrite the zlog_record_fn record_func function pointer to get arbitrary code execution or potentially cause remote code execution (RCE).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/15/2026
The vulnerability identified as CVE-2024-22857 represents a critical heap-based buffer overflow in the zlog logging library version range 1.1.0 through 1.2.17. This flaw exists within the zlog_rule_new() function where improper bounds checking allows for memory corruption during the processing of configuration file paths. The technical implementation reveals a fundamental mismatch in buffer size assumptions where record_name is allocated with a maximum size of MAXLEN_PATH(1024) + 1 bytes, while the source data file_path can potentially contain up to MAXLEN_CFG_LINE (which is defined as MAXLEN_PATH*4 + 1) bytes of data. This discrepancy creates an exploitable condition where data exceeding the allocated buffer size can overwrite adjacent memory locations.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially enable arbitrary code execution through the overwrite of the zlog_record_fn record_func function pointer. When an attacker successfully exploits this buffer overflow, they can manipulate the function pointer to redirect execution flow to malicious code, effectively achieving remote code execution capabilities. The vulnerability's exploitation requires control over the configuration file input that gets processed by zlog_rule_new(), making it particularly dangerous in environments where external configuration data is accepted without proper validation. This type of vulnerability aligns with CWE-121, heap-based buffer overflow, and maps to ATT&CK technique T1059.007 for command and script injection through malformed configuration inputs.
The root cause stems from inadequate input validation and buffer size checking within the zlog_rule_new() function during the copy operation from file_path to record_name. This flaw demonstrates poor defensive programming practices where the developers failed to implement proper bounds checking before memory copying operations. The vulnerability is particularly concerning because it operates at the library level, meaning any application using affected versions of zlog could be compromised, regardless of the application's own security measures. The potential for remote code execution makes this vulnerability especially attractive to threat actors, as it can be exploited through configuration file manipulation without requiring direct user interaction or complex attack vectors. Organizations should immediately update to patched versions of zlog or implement input sanitization measures to prevent exploitation of this heap-based buffer overflow vulnerability.