CVE-2021-35945
📋 TL;DR
CVE-2021-35945 is a buffer overflow vulnerability in Couchbase Server's memcached component that allows remote attackers to crash the service via specially crafted network packets. This affects Couchbase Server versions 6.5.x, 6.6.0-6.6.2, and 7.0.0. Organizations running these vulnerable versions with memcached exposed to untrusted networks are at risk.
💻 Affected Systems
- Couchbase Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service affecting all memcached operations, potentially leading to application downtime and data unavailability.
Likely Case
Service disruption causing memcached crashes and temporary unavailability until service restart.
If Mitigated
Minimal impact if network segmentation prevents untrusted access to memcached ports.
🎯 Exploit Status
Exploitation requires network access to memcached ports (typically 11210-11211). No authentication is required for the attack.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.6.3, 7.0.1, and later versions
Vendor Advisory: https://www.couchbase.com/alerts
Restart Required: Yes
Instructions:
1. Backup your Couchbase configuration and data. 2. Download the patched version from Couchbase downloads. 3. Follow Couchbase upgrade procedures for your specific version. 4. Restart Couchbase services after upgrade.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to memcached ports (11210-11211) to trusted networks only
iptables -A INPUT -p tcp --dport 11210:11211 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p tcp --dport 11210:11211 -j DROP
Firewall Rules
allBlock external access to memcached ports at network perimeter
🧯 If You Can't Patch
- Implement strict network access controls to limit memcached port exposure
- Monitor memcached service health and implement automated restart procedures for crashes
🔍 How to Verify
Check if Vulnerable:
Check Couchbase Server version: if running 6.5.x, 6.6.0-6.6.2, or 7.0.0, the system is vulnerable.Check Version:
couchbase-server --version 2>/dev/null || cat /opt/couchbase/VERSION.txtVerify Fix Applied:
Verify version is 6.6.3+, 7.0.1+, or later. Test memcached connectivity remains functional.📡 Detection & Monitoring
Log Indicators:
- Unexpected memcached process crashes
- Connection resets on memcached ports
- Error logs mentioning buffer overflow or segmentation fault
Network Indicators:
- Unusual traffic patterns to memcached ports
- Malformed packets targeting port 11210-11211
SIEM Query:
source="couchbase.log" AND ("crash" OR "segmentation fault" OR "buffer overflow")