CVE-2024-45773

Executive Summary

CVE-2024-45773 is a use-after-free vulnerability in Facebook Thrift, a cross-language serialization framework. The flaw resides in the handling of upgradeToRocket requests, where a dangling pointer can be dereferenced after the associated memory has been freed. This can lead to application crashes, arbitrary code execution, or other undefined behavior. The vulnerability affects all versions prior to v2024.09.09.00. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, given the widespread use of Thrift in distributed systems, the risk of targeted attacks remains.

Supply Chain & Package Security

This vulnerability is not directly related to NPM, PyPI, Go, or Ruby packages. However, Facebook Thrift is a core component in many backend services and may be distributed as a transitive dependency in various ecosystems. Organizations should audit their dependency trees for any use of the affected Thrift library.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the nature of the vulnerability (use-after-free in a network-facing component), a realistic assessment would be:

• Attack Vector (AV): Network (N) – The vulnerability can be triggered remotely via crafted upgradeToRocket requests.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond sending a malicious request.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Code execution could lead to data disclosure.
• Integrity (I): High (H) – Code execution could allow data modification.
• Availability (A): High (H) – The vulnerability can cause crashes.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability exists in the upgradeToRocket request handling logic within Facebook Thrift. When a client sends an upgradeToRocket request, the server processes it and may free certain memory structures associated with the connection. However, due to a race condition or improper reference counting, a pointer to the freed memory is retained and later dereferenced. This use-after-free condition can be exploited to achieve arbitrary code execution by carefully controlling the freed memory's contents.

The issue is specific to the C++ implementation of Thrift and does not affect other language bindings directly. The upgradeToRocket feature is used to upgrade a Thrift connection to a Rocket protocol connection, which is a more efficient binary protocol. The flaw was introduced in an earlier version and fixed in v2024.09.09.00.

Vulnerable vs. Patched Code

The vulnerable code path involves improper management of object lifetimes during the upgrade process. In the vulnerable version, the connection object is freed before all references to it are cleared. The patched version ensures that the connection object is not freed until all pending operations are complete.

Vulnerable Code (simplified):

void handleUpgradeToRocket(Connection* conn) {
    // ... process upgrade ...
    delete conn;  // Connection freed prematurely
    // Later, conn is used again -> use-after-free
    conn->sendResponse(...);
}

Patched Code (simplified):

void handleUpgradeToRocket(Connection* conn) {
    // ... process upgrade ...
    conn->markForDeletion();  // Mark for deletion, but don't free yet
    // All references are cleared before actual deletion
    conn->sendResponse(...);
    delete conn;  // Safe deletion after all uses
}

Exploitation & Lab Setup

No public exploit code is available for CVE-2024-45773. The following sections provide guidance for testing and defense.

Red Team (Exploitation)

To exploit this vulnerability, an attacker would need to:

1. Establish a Thrift connection to a vulnerable server.
2. Send a crafted upgradeToRocket request that triggers the use-after-free.
3. Heap spray to control the freed memory and achieve code execution.

A basic Python script to trigger the crash (not exploit) could look like:

import socket

def trigger_crash(host, port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((host, port))
    # Craft a malformed upgradeToRocket request
    # This is a simplified example; actual payload would need Thrift framing
    payload = b"\x00\x01\x00\x00\x00\x00\x00\x00"  # Placeholder
    sock.send(payload)
    sock.close()

if __name__ == "__main__":
    trigger_crash("target.example.com", 9090)

Blue Team (Detection & Prevention)

• Network Monitoring: Monitor for unusual Thrift traffic, especially upgradeToRocket requests from untrusted sources.
• Memory Protection: Enable ASLR, DEP, and stack canaries to mitigate exploitation.
• Patching: Immediately upgrade to Facebook Thrift v2024.09.09.00 or later.
• WAF Rules: Deploy Web Application Firewall rules to block malformed Thrift requests.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual Thrift upgradeToRocket requests with malformed framing.
  • Connections to port 9090 (default Thrift port) from suspicious IPs.
• Host IOCs:
  • Application crashes with use-after-free signatures in logs.
  • Unexpected memory corruption or heap spray patterns.
• File IOCs:
  • Modified Thrift library files (e.g., libthrift.so or thrift.dll).

Detection Engineering

YARA Rule

rule CVE_2024_45773_Thrift_UAF {
    meta:
        description = "Detects use-after-free pattern in Facebook Thrift upgradeToRocket"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45773"
    strings:
        $s1 = "upgradeToRocket" ascii wide nocase
        $s2 = "delete conn" ascii wide nocase
        $s3 = "conn->sendResponse" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2024-45773 - Facebook Thrift Use-After-Free
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of CVE-2024-45773 via malformed Thrift upgradeToRocket requests
author: Valters IT
date: 2024-10-27
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        app_protocol: thrift
        thrift.method: upgradeToRocket
        thrift.body|contains: 
            - "\\x00\\x01\\x00\\x00"  # Malformed framing
    condition: selection
falsepositives:
    - Legitimate upgrade requests from trusted clients
level: high

Suricata Rule

alert tcp any any -> any 9090 (msg:"CVE-2024-45773 - Facebook Thrift Use-After-Free"; flow:to_server,established; content:"|00 01 00 00|"; depth:4; content:"upgradeToRocket"; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patching: Upgrade to Facebook Thrift v2024.09.09.00 or later. This is the only complete fix.
2. Network Segmentation: Restrict access to Thrift services to trusted networks only.
3. Input Validation: Implement strict validation of upgradeToRocket requests at the application layer.
4. Memory Safety: Use memory-safe languages or enable runtime protections (e.g., AddressSanitizer) during development.
5. Monitoring: Deploy the detection rules above to identify exploitation attempts.
6. Incident Response: If exploitation is suspected, isolate affected systems and conduct forensic analysis.

Valters IT
DevSecOps & Cyber Threat Intelligence