CVE-2018-1000140
📋 TL;DR
A stack buffer overflow vulnerability in rsyslog's librelp library allows remote code execution when processing malicious x509 certificates. Attackers can exploit this by connecting to rsyslog and sending a specially crafted certificate. Systems using rsyslog with librelp version 1.2.14 or earlier are affected.
💻 Affected Systems
- rsyslog with librelp
- librelp library
📦 What is this software?
Librelp by Rsyslog
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains full control of the rsyslog server, potentially compromising the entire logging infrastructure and using it as a foothold for lateral movement.
Likely Case
Remote code execution leading to system compromise, data exfiltration, or deployment of malware/ransomware.
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized connections to rsyslog.
🎯 Exploit Status
Public exploit code exists in Packet Storm. Exploitation requires network access to rsyslog RELP port (default 20514).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: librelp 1.2.15 and later
Vendor Advisory: https://access.redhat.com/errata/RHSA-2018:1223
Restart Required: Yes
Instructions:
1. Update librelp package to version 1.2.15 or later. 2. For RHEL/CentOS: yum update librelp. 3. For Debian/Ubuntu: apt-get update && apt-get install librelp. 4. Restart rsyslog service: systemctl restart rsyslog
🔧 Temporary Workarounds
Disable RELP protocol
linuxIf RELP protocol is not required, disable it to prevent exploitation.
Comment out or remove RELP configuration lines in /etc/rsyslog.conf and /etc/rsyslog.d/*.conf
Restart rsyslog: systemctl restart rsyslog
Network access control
linuxRestrict network access to rsyslog RELP port using firewall rules.
iptables -A INPUT -p tcp --dport 20514 -j DROP
firewall-cmd --permanent --remove-port=20514/tcp
firewall-cmd --reload
🧯 If You Can't Patch
- Implement strict network segmentation to isolate rsyslog servers from untrusted networks
- Use host-based firewalls to restrict access to rsyslog RELP port (20514) only from trusted sources
🔍 How to Verify
Check if Vulnerable:
Check librelp version: rpm -q librelp or dpkg -l | grep librelp. If version is 1.2.14 or earlier, system is vulnerable.Check Version:
rpm -q librelp 2>/dev/null || dpkg -l | grep librelpVerify Fix Applied:
Verify librelp version is 1.2.15 or later: rpm -q librelp | grep 1.2.1[5-9]📡 Detection & Monitoring
Log Indicators:
- Unexpected connections to rsyslog RELP port
- Rsyslog process crashes or abnormal behavior
- Failed certificate validation errors
Network Indicators:
- Unusual network traffic to port 20514
- Large or malformed certificate data sent to rsyslog
SIEM Query:
source="rsyslog" AND ("certificate" OR "RELP") AND ("error" OR "failed" OR "crash")🔗 References
- http://packetstormsecurity.com/files/172829/librelp-Remote-Code-Execution.html
- https://access.redhat.com/errata/RHSA-2018:1223
- https://access.redhat.com/errata/RHSA-2018:1225
- https://access.redhat.com/errata/RHSA-2018:1701
- https://access.redhat.com/errata/RHSA-2018:1702
- https://access.redhat.com/errata/RHSA-2018:1703
- https://access.redhat.com/errata/RHSA-2018:1704
- https://access.redhat.com/errata/RHSA-2018:1707
- https://github.com/rsyslog/librelp/blob/532aa362f0f7a8d037505b0a27a1df452f9bac9e/src/tcp.c#L1205
- https://lgtm.com/rules/1505913226124/
- https://security.gentoo.org/glsa/201804-21
- https://usn.ubuntu.com/3612-1/
- https://www.debian.org/security/2018/dsa-4151
- http://packetstormsecurity.com/files/172829/librelp-Remote-Code-Execution.html
- https://access.redhat.com/errata/RHSA-2018:1223
- https://access.redhat.com/errata/RHSA-2018:1225
- https://access.redhat.com/errata/RHSA-2018:1701
- https://access.redhat.com/errata/RHSA-2018:1702
- https://access.redhat.com/errata/RHSA-2018:1703
- https://access.redhat.com/errata/RHSA-2018:1704
- https://access.redhat.com/errata/RHSA-2018:1707
- https://github.com/rsyslog/librelp/blob/532aa362f0f7a8d037505b0a27a1df452f9bac9e/src/tcp.c#L1205
- https://lgtm.com/rules/1505913226124/
- https://security.gentoo.org/glsa/201804-21
- https://usn.ubuntu.com/3612-1/
- https://www.debian.org/security/2018/dsa-4151
