CVE-2021-20235
📋 TL;DR
A buffer overflow vulnerability in ZeroMQ versions before 4.3.3 allows remote attackers to write arbitrary data when CURVE/ZAP authentication is disabled. This can lead to denial of service, data corruption, or potential remote code execution. Any system running vulnerable ZeroMQ servers with authentication disabled is affected.
💻 Affected Systems
- ZeroMQ (libzmq)
📦 What is this software?
Libzmq by Zeromq
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, and persistent backdoor installation.
Likely Case
Application crash causing denial of service and potential data corruption in affected ZeroMQ services.
If Mitigated
No impact if CURVE/ZAP authentication is enabled or if systems are properly patched.
🎯 Exploit Status
Exploitation requires sending crafted requests to vulnerable ZeroMQ servers with authentication disabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.3 and later
Vendor Advisory: https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6
Restart Required: Yes
Instructions:
1. Update libzmq to version 4.3.3 or later using your package manager. 2. For source installations: download latest release from github.com/zeromq/libzmq, compile and install. 3. Restart all ZeroMQ services.
🔧 Temporary Workarounds
Enable CURVE/ZAP Authentication
allEnable ZeroMQ's built-in authentication mechanisms to prevent exploitation
Configure ZeroMQ server with CURVE or ZAP authentication enabled
Network Segmentation
linuxRestrict access to ZeroMQ ports to trusted networks only
iptables -A INPUT -p tcp --dport <zmq_port> -s <trusted_network> -j ACCEPT
iptables -A INPUT -p tcp --dport <zmq_port> -j DROP
🧯 If You Can't Patch
- Enable CURVE or ZAP authentication on all ZeroMQ endpoints
- Implement network controls to restrict ZeroMQ traffic to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check ZeroMQ version and authentication configuration. Run: zmq_version or check package version.Check Version:
zmq_version or dpkg -l | grep libzmq or rpm -q zeromqVerify Fix Applied:
Verify ZeroMQ version is 4.3.3 or higher and authentication is properly configured.📡 Detection & Monitoring
Log Indicators:
- Unexpected ZeroMQ service crashes
- Memory access violation errors in application logs
- Abnormal ZeroMQ connection patterns
Network Indicators:
- Unusual traffic patterns to ZeroMQ ports
- Crafted packets targeting ZeroMQ services
SIEM Query:
source="*zmq*" AND (event_type="crash" OR error="buffer" OR error="overflow")