Use-After-Free Vulnerability in NanoMQ by EMQX
CVE-2023-33657

7.5HIGH

Key Information:

Vendor

EMQx

Status
NanoMQ
Vendor
CVE Published:
8 June 2023

What is CVE-2023-33657?

A use-after-free vulnerability has been identified in NanoMQ version 0.17.2, specifically within the function nni_mqtt_msg_get_publish_property() in mqtt_msg.c. This security flaw arises from inadequate data tracing, which may enable an attacker to manipulate memory allocation and potentially exploit this condition to trigger a denial of service attack, impacting the service availability of applications relying on NanoMQ.

References

https://github.com/emqx/nanomq
https://github.com/emqx/nanomq/issues/1165#issue-1668648319
https://github.com/emqx/nanomq/pull/1187

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.