Mosquitto: Use after free on mosquitto_acl_check
Basic information
Project name: Eclipse Mosquitto
Project id: iot.mosquitto
What are the affected versions?
2.0.18
We have not checked previous versions.
Details of the issue
We have found a heap-use-after-free vulnerability on Mosquitto 2.0.18 which occurs on src/security.c:688:15 (at function 'mosquitto_acl_check').
This vulnerability can be triggered by sending a specific sequence of the following packets:
CONNECT
SUBSCRIBE
UNSUBSCRIBE
DISCONNECT
CONNECT
PUBLISH
We attach the ASan stack trace of the vulnerability as well as the hex-encoded bytes of the packets ("%x" is used as a hex prefix).
Steps to reproduce
Run the attached replay_mqtt_finding.py script against a Mosquitto 2.0.18 broker which has been instrumented with ASan (AddressSanitizer).
Do you know any mitigations of the issue?
No.
Credit request
If you assign a CVE, is it possible to register the requested CVE with our names and organization name? We are Roman Kraus, Steffen Lüdtke, Martin Schneider and Ramon Barakat of Fraunhofer FOKUS.
Best regards,
Roman Kraus