CVE-2024-42649
📋 TL;DR
NanoMQ v0.22.10 contains a memory leak vulnerability in its MQTT PUBLISH message handling. Attackers can send crafted PUBLISH messages to gradually consume system memory, eventually causing a Denial of Service (DoS) crash. This affects all systems running the vulnerable NanoMQ version.
💻 Affected Systems
- NanoMQ
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage requiring manual restart, with potential data loss for in-flight messages and disruption to dependent IoT/MQTT applications.
Likely Case
Gradual performance degradation leading to eventual service crash, requiring restart and causing temporary service disruption.
If Mitigated
Minimal impact with proper monitoring and automated restart mechanisms in place.
🎯 Exploit Status
The vulnerability requires sending specially crafted MQTT PUBLISH messages. No authentication is required if the MQTT broker allows anonymous connections.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.22.11 or later
Vendor Advisory: https://github.com/nanomq/nanomq
Restart Required: Yes
Instructions:
1. Stop the NanoMQ service
2. Backup configuration files
3. Download and install NanoMQ v0.22.11 or later from GitHub releases
4. Restore configuration
5. Start the NanoMQ service
🔧 Temporary Workarounds
Rate Limit MQTT Connections
allImplement connection rate limiting to reduce the speed of memory consumption
# Configure in nanomq.conf: max_connections = 100
# Or use iptables: iptables -A INPUT -p tcp --dport 1883 -m connlimit --connlimit-above 10 -j DROP
Enable Authentication
allRequire MQTT client authentication to prevent anonymous exploitation
# In nanomq.conf: allow_anonymous = false
# Configure authentication: auth.1.login = username
auth.1.password = password
🧯 If You Can't Patch
- Implement network segmentation to isolate NanoMQ from untrusted networks
- Deploy memory monitoring with automated restart when thresholds are exceeded
🔍 How to Verify
Check if Vulnerable:
Check NanoMQ version with: nanomq --versionCheck Version:
nanomq --versionVerify Fix Applied:
Verify version is v0.22.11 or later and monitor memory usage during normal PUBLISH operations📡 Detection & Monitoring
Log Indicators:
- Rapid increase in memory usage in system logs
- NanoMQ crash logs with out-of-memory errors
- Unusual volume of MQTT PUBLISH messages from single sources
Network Indicators:
- High volume of MQTT PUBLISH packets from suspicious sources
- Abnormal connection patterns to port 1883
SIEM Query:
source="nanomq" AND ("out of memory" OR "memory allocation failed" OR "segmentation fault")