UAMQP: Memory Allocation Vulnerability May Lead to Remote Code Execution

CVE-2024-25110

What is CVE-2024-25110?

The UAMQP library, a widely-used C library designed for AMQP 1.0 applications, is impacted by a vulnerability that arises during the open_get_offered_capabilities function call. When a memory allocation fails, it may trigger a use-after-free condition, leading to potential remote code execution if exploited. This situation is particularly risky during ongoing connection communications. To mitigate this security threat, users are strongly encouraged to update their submodule to include the necessary fix implemented in commit 30865c9c. Currently, there are no established workarounds to alleviate the risk associated with this vulnerability.

News Articles

prophaze.com

CVE-2024-25110

CVE-2024-25110 : AZURE AZURE-UAMQP-C 1.0 OPEN_GET_OFFERED_CAPABILITIES USE AFTER FREE - Cloud WAF

CVE-2024-25110 : The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities.

References