CVE-2021-24028
📋 TL;DR
This vulnerability in Facebook Thrift's table-based serialization allows an invalid free operation that can crash applications or potentially lead to remote code execution. It affects all systems running Facebook Thrift versions prior to v2021.02.22.00. Attackers could exploit this to take control of affected systems.
💻 Affected Systems
- Facebook Thrift (fbthrift)
📦 What is this software?
Thrift by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or lateral movement within the network.
Likely Case
Application crashes causing denial of service, with potential for memory corruption leading to code execution in some scenarios.
If Mitigated
Application crashes with no code execution due to memory protections like ASLR and DEP.
🎯 Exploit Status
Exploitation requires sending specially crafted serialized data to a vulnerable Thrift endpoint. No public exploit code has been released.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2021.02.22.00 and later
Vendor Advisory: https://www.facebook.com/security/advisories/cve-2021-24028
Restart Required: Yes
Instructions:
1. Update Facebook Thrift to version v2021.02.22.00 or later. 2. Rebuild and redeploy any applications using Thrift. 3. Restart affected services.
🔧 Temporary Workarounds
Disable table-based serialization
allIf possible, configure applications to use binary or compact serialization instead of table-based serialization.
Network segmentation
allRestrict network access to Thrift services to only trusted sources.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all Thrift serialization inputs.
- Deploy memory protection mechanisms like ASLR, DEP, and control flow integrity where available.
🔍 How to Verify
Check if Vulnerable:
Check Thrift version in your application dependencies or system packages. Versions before v2021.02.22.00 are vulnerable.Check Version:
For Python: pip show thrift | grep Version; For system packages: rpm -q thrift or dpkg -l | grep thriftVerify Fix Applied:
Confirm Thrift version is v2021.02.22.00 or later and verify applications are using the updated library.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory corruption errors
- Segmentation faults in Thrift processes
- Unexpected process terminations
Network Indicators:
- Unusual Thrift protocol traffic patterns
- Large or malformed serialization payloads
SIEM Query:
source="thrift.log" AND (event="segfault" OR event="crash" OR event="memory_error")