Fluent Bit Memory Corruption Vulnerability Could Lead to Denial of Service, Information Disclosure, or Remote Code Execution
CVE-2024-4323

9.8CRITICAL

Key Information:

Vendor

Fluent Bit

Status
Fluent Bit
Vendor
CVE Published:
20 May 2024

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 84%📰 News Worthy

What is CVE-2024-4323?

A critical vulnerability, known as CVE-2024-4323, has been identified in Fluent Bit versions 2.0.7 thru 3.0.3, which may result in memory corruption leading to denial of service, information disclosure, or remote code execution. The vulnerability affects major cloud providers' offerings and the tech companies using them, but researchers state that exploiting the vulnerability for remote code execution is much harder. Tenable researchers have confirmed that the vulnerability has been exploited. The issue has been addressed in Fluent Bit v3.0.4, which companies are advised to upgrade to, or to ensure that access to Fluent Bit’s monitoring API is given only to authorized users and services. The affected cloud providers have been notified in order to initiate their internal triage processes.

Affected Version(s)

Fluent Bit 2.0.7 <= 3.0.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-4323-Exploit-POC
Created by skilfoy

News Articles

favicon imageSC Media

Memory corruption flaw in Fluent Bit could disrupt cloud platforms

Security pros warn that a bug in the popular open-source logging and metrics tool could cause denial-of-service attacks and data loss in all the major cloud platforms, including AWS, GCP and Azure.

favicon imageCyberWire

Alleged Incognito Market operator arrested. OmniVision discloses data breach. Critical flaw affects Fluent Bit.

Alleged Incognito Market operator arrested. OmniVision discloses data breach. Critical flaw affects Fluent Bit.

favicon imageThe Register

Critical Fluent Bit bug affects all major cloud providers

Infosec researchers are alerting the industry to a critical vulnerability in Fluent Bit – a logging component used by a swathe of blue chip companies and all three major cloud providers. Experts at Tenable...

References

https://tenable.com/security/research/tra-2024-17
https://github.com/fluent/fluent-bit/commit/9311b43a25835...

EPSS Score

84% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by Tenable

  • Vulnerability published

JSON
.
CVE-2024-4323 : Fluent Bit Memory Corruption Vulnerability Could Lead to Denial of Service, Information Disclosure, or Remote Code Execution