Summary:
A critical vulnerability in Fluent Bit has been identified, impacting major cloud providers and numerous tech giants by exposing them to denial-of-service and remote code execution attacks. Fluent Bit, a popular logging and metrics solution for Windows, Linux, and macOS, is embedded in major Kubernetes distributions. The software has seen rapid adoption, with downloads surpassing 13 billion by March 2024, up from three billion in October 2022. This vulnerability, tracked as CVE-2024-4323 and dubbed "Linguistic Lumberjack" by Tenable security researchers, stems from a heap buffer overflow in Fluent Bit's embedded HTTP server during trace request parsing.

Security Officer Comments:
Discovered in version 2.0.7, this flaw allows unauthenticated attackers to easily trigger denial-of-service attacks and capture sensitive information. Specifically, it relates to sending maliciously crafted requests to the monitoring API through endpoints such as /api/v1/traces and /api/v1/trace. By default, the data types are assumed to be strings (i.e., MSGPACK_OBJECT_STR), which a threat actor could exploit by passing non-string values, leading to memory corruption. Under certain conditions, it can also enable remote code execution, though developing a reliable exploit for this is notably difficult and time-intensive.

Suggested Corrections:
Tenable disclosed the security flaw to the Fluent Bit vendor on April 30, and a patch was committed to the main branch on May 15. The official release of this patch is expected with Fluent Bit 3.0.4. Companies that deploy it in their environments are advised to upgrade to Fluent Bit v3.0.4, which will be released soon. To mitigate the risk until the patch is broadly available, users are advised to limit access to Fluent Bit's monitoring API to authorized personnel and services. Additionally, disabling the vulnerable API endpoint, if not in use, is recommended to minimize the attack surface and prevent potential exploits.

Link(s):
https://www.bleepingcomputer.com/ne...t-bit-flaw-impacts-all-major-cloud-providers/

https://www.tenable.com/blog/lingui...ia-logging-endpoints-fluent-bit-cve-2024-4323