CVE-2020-35963
📋 TL;DR
CVE-2020-35963 is an out-of-bounds write vulnerability in Fluent Bit's gzip compression function that could allow attackers to execute arbitrary code or cause denial of service. This affects all systems running Fluent Bit versions before 1.6.4 that use gzip compression. The vulnerability stems from incorrect calculation of maximum gzip data-size expansion.
💻 Affected Systems
- Fluent Bit
📦 What is this software?
Fluent Bit by Treasuredata
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or persistent backdoor installation.
Likely Case
Denial of service through application crashes or memory corruption, potentially disrupting log processing pipelines.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are implemented, though service disruption remains possible.
🎯 Exploit Status
Proof-of-concept exists in OSS-Fuzz reports. Exploitation requires sending specially crafted gzip data to the vulnerable component.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.4 and later
Vendor Advisory: https://fluentbit.io/announcements/v1.6.4/
Restart Required: Yes
Instructions:
1. Download Fluent Bit 1.6.4 or later from https://fluentbit.io/download/ 2. Stop Fluent Bit service 3. Install the new version 4. Restart Fluent Bit service
🔧 Temporary Workarounds
Disable gzip compression
allDisable gzip compression functionality to prevent exploitation
Modify Fluent Bit configuration to remove or disable gzip compression options
Network segmentation
allRestrict network access to Fluent Bit instances
Configure firewall rules to limit inbound connections to Fluent Bit
🧯 If You Can't Patch
- Implement strict network access controls to limit who can send data to Fluent Bit instances
- Monitor for abnormal memory usage or crashes in Fluent Bit processes
🔍 How to Verify
Check if Vulnerable:
Check Fluent Bit version with 'fluent-bit --version' or examine installed package versionCheck Version:
fluent-bit --versionVerify Fix Applied:
Confirm version is 1.6.4 or higher and test gzip compression functionality📡 Detection & Monitoring
Log Indicators:
- Fluent Bit process crashes
- Memory allocation errors in logs
- Abnormal termination messages
Network Indicators:
- Unusual gzip-compressed traffic patterns to Fluent Bit ports
- Multiple connection attempts with compressed data
SIEM Query:
source="fluent-bit" AND ("segmentation fault" OR "out of bounds" OR "memory corruption" OR "gzip error")🔗 References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27261
- https://fluentbit.io/announcements/v1.6.4/
- https://github.com/fluent/fluent-bit/commit/cadff53c093210404aed01c4cf586adb8caa07af
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27261
- https://fluentbit.io/announcements/v1.6.4/
- https://github.com/fluent/fluent-bit/commit/cadff53c093210404aed01c4cf586adb8caa07af
