CVE-2023-29994
📋 TL;DR
A heap overflow vulnerability in NanoMQ's read_byte function allows attackers to write beyond allocated memory boundaries. This affects all systems running vulnerable versions of NanoMQ, potentially leading to remote code execution or service crashes.
💻 Affected Systems
- NanoMQ
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with attacker gaining full control of the NanoMQ server, potentially leading to complete system compromise.
Likely Case
Service crash (denial of service) or memory corruption leading to unstable behavior.
If Mitigated
Limited impact if proper memory protections (ASLR, DEP) are enabled and the service runs with minimal privileges.
🎯 Exploit Status
Heap overflow vulnerabilities typically require careful crafting of malicious MQTT packets but can be exploited without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.15.1 or later
Vendor Advisory: https://github.com/emqx/nanomq/issues/1042
Restart Required: Yes
Instructions:
1. Stop NanoMQ service. 2. Backup configuration files. 3. Download and install NanoMQ v0.15.1 or later from official repository. 4. Restore configuration. 5. Start NanoMQ service.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to NanoMQ MQTT port (default 1883) to trusted networks only
iptables -A INPUT -p tcp --dport 1883 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 1883 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Monitor for abnormal memory usage or crashes in NanoMQ processes
🔍 How to Verify
Check if Vulnerable:
Check NanoMQ version: nanomq --version or examine installed package versionCheck Version:
nanomq --versionVerify Fix Applied:
Verify version is v0.15.1 or later and test MQTT connectivity📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors
- Memory allocation failures
- Unexpected process termination
Network Indicators:
- Unusual MQTT packet sizes
- Malformed MQTT packets
- Connection attempts with abnormal payloads
SIEM Query:
process_name="nanomq" AND (event_type="crash" OR memory_usage>threshold)