CVE-2021-20236
📋 TL;DR
A stack buffer overflow vulnerability in ZeroMQ servers before version 4.3.3 allows malicious clients to execute arbitrary code or crash the server by sending crafted topic subscription requests followed by unsubscribe commands. This affects any system running vulnerable ZeroMQ server instances, particularly those exposed to untrusted clients. The vulnerability compromises confidentiality, integrity, and availability.
💻 Affected Systems
- ZeroMQ (libzmq)
- Any software using vulnerable ZeroMQ library
📦 What is this software?
Fedora by Fedoraproject
Zeromq by Zeromq
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, and persistent backdoor installation
Likely Case
Server crash causing denial of service and potential data corruption in connected applications
If Mitigated
Limited impact with proper network segmentation and access controls, potentially just service disruption
🎯 Exploit Status
Exploitation requires sending specific crafted subscription/unsubscribe sequences. Public proof-of-concept demonstrates crash, but full RCE may require additional exploitation techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.3 and later
Vendor Advisory: https://github.com/zeromq/libzmq/security/advisories/GHSA-qq65-x72m-9wr8
Restart Required: Yes
Instructions:
1. Update ZeroMQ library to version 4.3.3 or later. 2. Recompile any applications using ZeroMQ. 3. Restart all ZeroMQ services and dependent applications.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict ZeroMQ server access to trusted clients only using firewall rules
iptables -A INPUT -p tcp --dport [ZEROMQ_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [ZEROMQ_PORT] -j DROP
Disable Vulnerable Patterns
allIf possible, avoid using PUB/SUB patterns with topic subscriptions in vulnerable versions
🧯 If You Can't Patch
- Implement strict network access controls to limit ZeroMQ server exposure to only essential, trusted clients
- Monitor for abnormal subscription/unsubscribe patterns and implement rate limiting on subscription requests
🔍 How to Verify
Check if Vulnerable:
Check ZeroMQ version: zmq --version or examine linked library version in applicationsCheck Version:
zmq --version || ldd /path/to/application | grep libzmq || dpkg -l | grep libzmq || rpm -qa | grep zeromqVerify Fix Applied:
Confirm version is 4.3.3 or higher: zmq --version | grep -q '4\.3\.[3-9]\|4\.[4-9]\|5\.'📡 Detection & Monitoring
Log Indicators:
- Multiple rapid subscription/unsubscribe requests
- ZeroMQ server crashes or segmentation faults
- Abnormal memory usage patterns
Network Indicators:
- Unusual subscription patterns from single clients
- Multiple SUB/UNSUB commands in short timeframes
SIEM Query:
source="zeromq.log" AND ("segmentation fault" OR "buffer overflow" OR "subscription" AND "unsubscribe" within 1s)