CVE-2024-1023 Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
Problem types: cwe_id: CWE-401
description: Missing Release of Memory after Effective Lifetime
Affected products: default_status: unaffected
vendor: Red Hat
product: CEQ 3.2
cpes: cpe:/a:redhat:camel_quarkus:3
default_status: unaffected
vendor: Red Hat
product: Cryostat 2 on RHEL 8
cpes: cpe:/a:redhat:cryostat:2::el8
default_status: affected
vendor: Red Hat
product: Cryostat 2 on RHEL 8
cpes: cpe:/a:redhat:cryostat:2::el8
default_status: affected
vendor: Red Hat
product: Cryostat 2 on RHEL 8
cpes: cpe:/a:redhat:cryostat:2::el8
default_status: affected
vendor: Red Hat
product: Cryostat 2 on RHEL 8
cpes: cpe:/a:redhat:cryostat:2::el8
default_status: affected
vendor: Red Hat
product: Cryostat 2 on RHEL 8
cpes: cpe:/a:redhat:cryostat:2::el8
default_status: affected
vendor: Red Hat
product: Cryostat 2 on RHEL 8
cpes: cpe:/a:redhat:cryostat:2::el8
default_status: affected
vendor: Red Hat
product: MTA-6.2-RHEL-9
cpes: cpe:/a:redhat:migration_toolkit_applications:6.2::el8
cpe:/a:redhat:migration_toolkit_applications:6.2::el9
default_status: affected
vendor: Red Hat
product: Red Hat AMQ Streams 2.7.0
cpes: cpe:/a:redhat:amq_streams:2
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
cpes: cpe:/a:redhat:apache_camel_spring_boot:4.4::el6
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Quarkus 3.2.11.Final
cpes: cpe:/a:redhat:quarkus:3.2::el8
default_status: affected
vendor: Red Hat
product: RHINT Service Registry 2.5.11 GA
cpes: cpe:/a:redhat:service_registry:2.5
default_status: unaffected
vendor: Red Hat
product: A-MQ Clients 2
cpes: cpe:/a:redhat:a_mq_clients:2
default_status: unaffected
vendor: Red Hat
product: Migration Toolkit for Runtimes
cpes: cpe:/a:redhat:migration_toolkit_runtimes:1
default_status: affected
vendor: Red Hat
product: OpenShift Serverless
cpes: cpe:/a:redhat:serverless:1
default_status: unaffected
vendor: Red Hat
product: Red Hat AMQ Broker 7
cpes: cpe:/a:redhat:amq_broker:7
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Apache Camel for Spring Boot 3
cpes: cpe:/a:redhat:camel_spring_boot:3
default_status: affected
vendor: Red Hat
product: Red Hat Build of Keycloak
cpes: cpe:/a:redhat:build_keycloak:
default_status: affected
vendor: Red Hat
product: Red Hat build of OptaPlanner 8
cpes: cpe:/a:redhat:optaplanner:::el6
default_status: affected
vendor: Red Hat
product: Red Hat build of Quarkus
cpes: cpe:/a:redhat:quarkus:2
default_status: unaffected
vendor: Red Hat
product: Red Hat Data Grid 8
cpes: cpe:/a:redhat:jboss_data_grid:8
default_status: affected
vendor: Red Hat
product: Red Hat Fuse 7
cpes: cpe:/a:redhat:jboss_fuse:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Integration Camel K 1
cpes: cpe:/a:redhat:integration:1
default_status: affected
vendor: Red Hat
product: Red Hat Integration Camel Quarkus 2
cpes: cpe:/a:redhat:camel_quarkus:2
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Data Grid 7
cpes: cpe:/a:redhat:jboss_data_grid:7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
cpes: cpe:/a:redhat:jbosseapxp
default_status: unaffected
vendor: Red Hat
product: Red Hat Process Automation 7
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-03-27T07:51:15.716Z