<!-- Required. Specify the project's name (e.g., "Eclipse Dash") and Eclipse Foundation ID, e.g., "technology.dash". --> ## Basic information **Project name:** Eclipse Mosquitto **Project id:** iot.mosquitto ## What are the affected versions? 2.0.18 We have not checked previous versions. ## Details of the issue We have found a heap-use-after-free vulnerability on Mosquitto 2.0.18 which occurs on src/subs.c:165:38 (at function 'sub__add_leaf'). This vulnerability can be triggered by sending a specific sequence of the following packets: CONNECT\ SUBSCRIBE\ UNSUBSCRIBE\ DISCONNECT\ CONNECT\ SUBSCRIBE We attach the ASan stack trace of the vulnerability as well as the hex-encoded bytes of the packets ("%x" is used as a hex prefix). ## Steps to reproduce Run the attached `replay_mqtt_finding.py` script against a Mosquitto 2.0.18 broker which has been instrumented with ASan (AddressSanitizer). ## Do you know any mitigations of the issue? No. ## Credit request If you assign a CVE, is it possible to register the requested CVE with our names and organization name? We are Roman Kraus, Steffen Lüdtke, Martin Schneider and Ramon Barakat of Fraunhofer FOKUS. Best regards,\ Roman Kraus <!-- Please, do not remove the line below. It will create a confidential issue that will be visible only to you and the members of this project. Confidential issues are used to keep security vulnerabilities private until they are sorted out. Eclipse Projects follow Responsible Disclosure best practices: the initial report is made privately, but with the full details being published once a patch has been made available (sometimes with a delay to allow more time for the patches to be installed). --> [shared_sub_uaf.zip](/uploads/06b30821ce273a727b8ef92a5c9808b1/shared_sub_uaf.zip)