CVE-2020-36400 – CVE-2020-36400 is a heap-based buffer overflow ... (How to Fix)

Q: What is the severity of CVE-2020-36400?

CVE-2020-36400 has a CVSS score of 9.8 (CRITICAL). CVE-2020-36400 is a heap-based buffer overflow vulnerability in ZeroMQ's libzmq library that allows remote attackers to execute arbitrary code or cause denial of service. The vulnerability exists in the zmq::tcp_read function and affects systems using vulnerable versions of ZeroMQ for network communication. This is a critical vulnerability with CVSS 9.8 that can be exploited remotely without authentication.

📋 TL;DR

CVE-2020-36400 is a heap-based buffer overflow vulnerability in ZeroMQ's libzmq library that allows remote attackers to execute arbitrary code or cause denial of service. The vulnerability exists in the zmq::tcp_read function and affects systems using vulnerable versions of ZeroMQ for network communication. This is a critical vulnerability with CVSS 9.8 that can be exploited remotely without authentication.

💻 Affected Systems

Products:

ZeroMQ libzmq

Versions: libzmq 4.3.3 specifically, potentially other versions with similar code

Operating Systems: All platforms where ZeroMQ runs (Linux, Windows, macOS, etc.)

Default Config Vulnerable: ⚠️ Yes

Notes: Any application using ZeroMQ for TCP communication is potentially vulnerable when processing malicious network data

📦 What is this software?

Libzmq by Zeromq

View all CVEs affecting Libzmq →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, or ransomware deployment

🟠

Likely Case

Denial of service causing application crashes and service disruption

🟢

If Mitigated

Limited impact if network segmentation and proper access controls prevent exploitation attempts

🌐 Internet-Facing: HIGH - Remote exploitation without authentication makes internet-facing systems prime targets

🏢 Internal Only: MEDIUM - Internal systems could still be exploited by compromised internal hosts or malicious insiders

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability was discovered through fuzzing and has public proof-of-concept available. Heap buffer overflows are commonly weaponized for RCE.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in commit 397ac80850bf8d010fae23dd215db0ee2c677306 and later versions

Vendor Advisory: https://github.com/zeromq/libzmq/commit/397ac80850bf8d010fae23dd215db0ee2c677306

Restart Required: Yes

Instructions:

1. Update ZeroMQ to version 4.3.4 or later. 2. Recompile applications linking against libzmq. 3. Restart all services using ZeroMQ.

🔧 Temporary Workarounds

Network Segmentation

linux

Restrict network access to ZeroMQ services to trusted hosts only

iptables -A INPUT -p tcp --dport <zmq_port> -s <trusted_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport <zmq_port> -j DROP

Process Isolation

linux

Run ZeroMQ applications with minimal privileges and in isolated containers

docker run --cap-drop=ALL --security-opt=no-new-privileges <zmq_container>

🧯 If You Can't Patch

Implement strict network access controls to limit exposure to trusted sources only
Deploy runtime protection solutions that can detect and prevent buffer overflow exploitation

🔍 How to Verify

Check if Vulnerable:

Check ZeroMQ version: zmq_version() in code or check installed package version

Check Version:

zmq_version() in application code or 'dpkg -l | grep libzmq' on Debian/Ubuntu, 'rpm -qa | grep zeromq' on RHEL

Verify Fix Applied:

Verify version is 4.3.4 or later and confirm commit 397ac80850bf8d010fae23dd215db0ee2c677306 is included

📡 Detection & Monitoring

Log Indicators:

Segmentation fault crashes in ZeroMQ processes
Abnormal memory usage patterns in ZeroMQ applications

Network Indicators:

Unusual TCP traffic patterns to ZeroMQ ports
Malformed packet sequences targeting ZeroMQ services

SIEM Query:

source="*zmq*" AND (event_type="crash" OR event_type="segfault")

📊 Metadata

CVE ID: CVE-2020-36400

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: July 1, 2021

Last Updated: November 21, 2024

🔗 References

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26042 Issue Tracking,Mailing List,Patch,Third Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libzmq/OSV-2020-1887.yaml Third Party Advisory
https://github.com/zeromq/libzmq/commit/397ac80850bf8d010fae23dd215db0ee2c677306 Patch,Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26042 Issue Tracking,Mailing List,Patch,Third Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libzmq/OSV-2020-1887.yaml Third Party Advisory
https://github.com/zeromq/libzmq/commit/397ac80850bf8d010fae23dd215db0ee2c677306 Patch,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-36400, you might also want to check these: