CVE-2025-29478
📋 TL;DR
A local denial-of-service vulnerability in fluent-bit v3.7.2 allows attackers to crash the service by exploiting a flaw in the cfl_list_size function. This affects systems running the vulnerable version of fluent-bit where local users have access to the service. The vulnerability requires local access to the system.
💻 Affected Systems
- fluent-bit
📦 What is this software?
Fluent Bit by Treasuredata
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of fluent-bit, causing log collection and forwarding to stop, potentially affecting monitoring and observability systems.
Likely Case
Local user causes fluent-bit to crash, requiring manual restart and causing temporary log collection gaps.
If Mitigated
Minimal impact with proper access controls and monitoring in place to detect and restart crashed services.
🎯 Exploit Status
Proof of concept available in public repository, requires local access to system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.7.3 or later
Vendor Advisory: https://github.com/fluent/fluent-bit/security/advisories
Restart Required: Yes
Instructions:
1. Check current version: fluent-bit --version
2. Download latest release from https://github.com/fluent/fluent-bit/releases
3. Stop fluent-bit service: systemctl stop fluent-bit
4. Install new version following platform-specific instructions
5. Start service: systemctl start fluent-bit
🔧 Temporary Workarounds
Restrict local access
linuxLimit which local users can interact with fluent-bit service
chmod 750 /usr/local/bin/fluent-bit
setfacl -m u:fluentbit:rx /usr/local/bin/fluent-bit
Implement service monitoring
linuxSet up automatic restart for crashed fluent-bit service
systemctl edit fluent-bit
Add: Restart=always
Add: RestartSec=5
🧯 If You Can't Patch
- Implement strict access controls to limit which local users can interact with fluent-bit
- Deploy monitoring to detect and automatically restart crashed fluent-bit instances
🔍 How to Verify
Check if Vulnerable:
Check fluent-bit version: fluent-bit --version | grep -q '3.7.2' && echo 'VULNERABLE' || echo 'SAFE'Check Version:
fluent-bit --versionVerify Fix Applied:
Verify version is 3.7.3 or later: fluent-bit --version | grep -E '3.7.[3-9]|3.[8-9]'📡 Detection & Monitoring
Log Indicators:
- fluent-bit crash logs
- segmentation fault errors in system logs
- service restart messages
Network Indicators:
- Sudden stop of log forwarding from affected host
SIEM Query:
source="fluent-bit" AND ("segmentation fault" OR "crash" OR "SIGSEGV")