Medium severity · published Mar 27, 2024
CVE-2024-1023
Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx
6.5
CVSS
1.7%
EPSS
No
On KEV
Description
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C2
Cryostat 2 on RHEL 8 · Red Hat
All versions, or not specified · source: vendor
MT
MTA-6.2-RHEL-9 · Red Hat
All versions, or not specified · source: vendor
MT
Migration Toolkit for Runtimes · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Build of Keycloak · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Data Grid 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Integration Camel K 1 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Integration Camel Quarkus 2 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Data Grid 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Apache Camel 4 for Quarkus 3 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Apache Camel for Spring Boot 3 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of OptaPlanner 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Quarkus 3.2.11.Final · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1023
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1023
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:1662
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:1706
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:2088
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:2833
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:3527
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:3989
More from Cryostat 2 on RHEL 8
5.4
CVE-2024-1300
Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support
