CVE-2024-31036

Executive Summary

CVE-2024-31036 is a heap-buffer-overflow vulnerability identified in NanoMQ v0.21.7, specifically within the read_byte function. This flaw allows an attacker to cause a denial of service (DoS) by transmitting crafted hex streams. The vulnerability has a CVSS score of 0.0, indicating incomplete scoring data, but the potential impact is significant for systems relying on NanoMQ for MQTT messaging. The EPSS score is 0.0%, suggesting low exploitation likelihood currently, but the lack of a patch increases risk. No public proof-of-concept (PoC) or exploit code is available, and no GitHub advisory or OSV patch data exists.

Supply Chain & Package Security

NanoMQ is a lightweight MQTT broker written in C, commonly used in IoT and edge computing environments. This vulnerability affects the core binary distribution. Users should verify the integrity of their NanoMQ installations and monitor for updates from the vendor. No package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality Impact (C): None (likely)
• Integrity Impact (I): None (likely)
• Availability Impact (A): High (likely)
• Threat Level: Medium (due to DoS potential and lack of patch)

Deep Dive & Mechanics

The vulnerability resides in the read_byte function within NanoMQ's packet parsing logic. A heap-buffer-overflow occurs when the function reads beyond the allocated buffer while processing specially crafted hex streams. This can corrupt heap metadata, leading to application crashes or potential code execution under certain conditions. The root cause is insufficient bounds checking on input data length before memory operations.

Technical Details:

• Affected Function: read_byte in nng/mqtt/packet.c (or similar)
• Trigger: Sending a malformed MQTT CONNECT or PUBLISH packet with an oversized or malformed hex-encoded payload.
• Impact: Denial of service via segmentation fault or heap corruption.

Vulnerable vs. Patched Code

Vulnerable Code (v0.21.7):

// Hypothetical vulnerable implementation
int read_byte(uint8_t *buf, size_t len, size_t *offset) {
    if (*offset >= len) return -1;
    uint8_t byte = buf[*offset];
    (*offset)++;
    return byte;
}

Issue: No validation of buf size relative to offset beyond simple bounds check; heap buffer may be smaller than len.

Patched Code (Hypothetical):

// Patched version with proper bounds checking
int read_byte(uint8_t *buf, size_t buf_size, size_t *offset) {
    if (*offset >= buf_size) return -1;
    uint8_t byte = buf[*offset];
    (*offset)++;
    return byte;
}

Fix: Ensure buf_size reflects actual allocated heap size, not just input length.

Exploitation & Lab Setup

Red Team

Prerequisites:

• NanoMQ v0.21.7 running on a target system (default port 1883 for MQTT).
• Network access to the broker.

Exploitation Steps:

1. Craft a malicious MQTT packet with a hex-encoded payload exceeding the expected buffer size.
2. Send the packet to the broker using a tool like mosquitto_pub or a custom Python script.
3. Observe the broker crash or become unresponsive.

Example Python Script:

import socket

def exploit(target_ip, target_port=1883):
    # Craft a malformed MQTT CONNECT packet with oversized hex payload
    # This is a simplified example; actual payload requires protocol analysis
    payload = b'\x10' + b'\x00\x00'  # Placeholder
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    sock.send(payload)
    sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100")

Blue Team

Detection:

• Monitor for malformed MQTT packets with abnormal payload sizes.
• Use network intrusion detection systems (NIDS) to flag hex-encoded payloads exceeding thresholds.
• Enable logging on NanoMQ to capture crash dumps.

Mitigation:

• Restrict network access to NanoMQ broker using firewall rules.
• Implement rate limiting and payload size validation at the network edge.
• Monitor for unexpected broker restarts or crashes.

Indicators of Compromise (IOCs)

• Network: MQTT packets with hex-encoded payloads exceeding 256 bytes (typical limit).
• System: NanoMQ process crash logs showing heap-buffer-overflow in read_byte.
• File: Core dumps from /var/log/nanomq/ or similar.
• Behavior: Broker unavailability or repeated crashes.

Detection Engineering

YARA Rule

rule CVE_2024_31036_NanoMQ_HeapOverflow {
    meta:
        description = "Detects heap-buffer-overflow in NanoMQ read_byte function"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-31036"
    strings:
        $s1 = "read_byte" ascii wide nocase
        $s2 = "heap-buffer-overflow" ascii wide nocase
    condition:
        $s1 or $s2
}

Sigma Rule

title: NanoMQ Heap Buffer Overflow Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-31036 via malformed MQTT packets
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/nanomq'
        CommandLine|contains: 'crash'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert tcp any any -> any 1883 (msg:"CVE-2024-31036 NanoMQ Heap Overflow Attempt"; flow:to_server,established; content:"|10|"; depth:1; content:"|00 00|"; within:2; byte_test:2,>,256,2; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate: Restrict network access to NanoMQ broker to trusted hosts only.
2. Monitor: Enable detailed logging and monitor for crashes.
3. Workaround: If possible, disable hex-encoded payload support or implement input validation at a reverse proxy.

Long-term Fix:

• Await an official patch from NanoMQ. Upgrade to a patched version once released.
• Consider switching to an alternative MQTT broker (e.g., Mosquitto, EMQX) if patch is delayed.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert