Buffer overflow in Haproxy
CVE-2018-10184
An issue was discovered in HAProxy before 1.8.8. The incoming H2 frame length was checked against the max_frame_size setting instead of being checked against the bufsize. The max_frame_size only applies to outgoing traffic and not to incoming, so if a large enough frame size is advertised in the SETTINGS frame, a wrapped frame will be defragmented into a temporary allocated buffer where the second fragment may overflow the heap by up to 16 kB. It is very unlikely that this can be exploited for code execution given that buffers are very short lived and their addresses not realistically predictable in production, but the likelihood of an immediate crash is absolutely certain.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.083 (94.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 94.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.084 · newest: 0.083 · change: -0.001
Affected products
- Haproxy
- Red Hat Enterprise Linux — versions 7.0, 7.3, 7.4
Weakness classification (CWE)
Public proof-of-concept exploits
References
- git.haproxy.org/
- access.redhat.com/errata/RHSA-2018:1372 (vendor-advisory, Third Party Advisory)
- git.haproxy.org/
Frequently asked questions
- What is CVE-2018-10184?
- CVE-2018-10184 is a high-severity vulnerability in Haproxy, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.5/10. Published 2018-05-09.
- How severe is CVE-2018-10184?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2018-10184 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.