CVE-2021-36082
📋 TL;DR
CVE-2021-36082 is a stack-based buffer overflow vulnerability in ntop nDPI's processClientServerHello function. This allows remote attackers to execute arbitrary code or cause denial of service by sending specially crafted network packets. Organizations using nDPI for deep packet inspection are affected.
💻 Affected Systems
- ntop nDPI
📦 What is this software?
Ndpi by Ntop
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with root/system privileges leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of service causing nDPI service crashes and disruption of network monitoring capabilities.
If Mitigated
Limited impact if network segmentation prevents external access to nDPI instances and proper input validation is in place.
🎯 Exploit Status
Proof-of-concept available through OSS-Fuzz reports. Exploitation requires sending malicious network packets to trigger the buffer overflow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 1ec621c85b9411cc611652fd57a892cfef478af3 and later versions
Vendor Advisory: https://github.com/ntop/nDPI/commit/1ec621c85b9411cc611652fd57a892cfef478af3
Restart Required: Yes
Instructions:
1. Update nDPI to version after commit 1ec621c85b9411cc611652fd57a892cfef478af3. 2. Recompile any applications using nDPI. 3. Restart services using nDPI library.
🔧 Temporary Workarounds
Network Segmentation
allIsolate nDPI instances from untrusted networks to prevent external exploitation.
Input Validation
allImplement additional packet validation before passing to nDPI processing.
🧯 If You Can't Patch
- Implement strict network access controls to limit which systems can send traffic to nDPI instances
- Deploy intrusion detection systems to monitor for exploitation attempts and anomalous traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check nDPI version: if version is 3.4 or earlier, system is vulnerable. Verify by checking library version or commit hash.Check Version:
Check nDPI source code or compiled library version informationVerify Fix Applied:
Confirm nDPI version is after commit 1ec621c85b9411cc611652fd57a892cfef478af3. Test with known malicious packets if possible.📡 Detection & Monitoring
Log Indicators:
- nDPI service crashes
- segmentation fault errors in system logs
- unexpected process termination
Network Indicators:
- Unusual TLS/SSL handshake patterns
- malformed network packets targeting nDPI ports
- traffic spikes to nDPI services
SIEM Query:
source="nDPI" AND (event="crash" OR event="segfault" OR severity="critical")🔗 References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30393
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ndpi/OSV-2021-304.yaml
- https://github.com/ntop/nDPI/commit/1ec621c85b9411cc611652fd57a892cfef478af3
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30393
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ndpi/OSV-2021-304.yaml
- https://github.com/ntop/nDPI/commit/1ec621c85b9411cc611652fd57a892cfef478af3
