Azure azure-c-shared-utility prior 2024-02-08 buffer overflow

Summaryinfo

A vulnerability identified as critical has been detected in Azure azure-c-shared-utility. Affected by this vulnerability is an unknown functionality. This manipulation causes buffer overflow. This vulnerability is tracked as CVE-2024-29195. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Azure azure-c-shared-utility and classified as problematic. Affected by this vulnerability is some unknown functionality. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The azure-c-shared-utility is a C library for AMQP/MQTT communication to Azure Cloud Services. This library may be used by the Azure IoT C SDK for communication between IoT Hub and IoT Hub devices. An attacker can cause an integer wraparound or under-allocation or heap buffer overflow due to vulnerabilities in parameter checking mechanism, by exploiting the buffer length parameter in Azure C SDK, which may lead to remote code execution. Requirements for RCE are 1. Compromised Azure account allowing malformed payloads to be sent to the device via IoT Hub service, 2. By passing IoT hub service max message payload limit of 128KB, and 3. Ability to overwrite code space with remote code. Fixed in commit https://github.com/Azure/azure-c-shared-utility/commit/1129147c38ac02ad974c4c701a1e01b2141b9fe2.

The advisory is shared at github.com. This vulnerability is known as CVE-2024-29195 since 03/18/2024. The exploitation appears to be difficult. The attack can be launched remotely. Additional levels of successful authentication are required for exploitation. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 233164 (Azure Linux 3.0 Security Update: azure-iot-sdk-c (CVE-2024-29195)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2024-02-08 eliminates this vulnerability. Applying the patch 1129147c38ac02ad974c4c701a1e01b2141b9fe2 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (233164). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Azure

Name

• azure-c-shared-utility

License

• open-source

Website

• Product: https://github.com/Azure/azure-c-shared-utility/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion