Описание
Atom table exhaustion via stream chunk_selector
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Source references
deps/rabbitmq_stream/src/rabbit_stream_reader.erl:4141 · Resource exhaustion (atom table DoS)
Impact
An authenticated stream client with read access to any stream can crash the broker node.
Description
get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no _existing_ guard.
Exploit scenario
Attacker opens a stream connection (port 5552), authenticates, and repeatedly sends subscribe frames with property chunk_selector set to a fresh random string each time. Each frame interns a new atom; after ~1M frames the VM aborts.
Preconditions
- rabbitmq_stream plugin enabled
- Authenticated stream-protocol user with read access to at least one stream
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (6.0, Moderate). Fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.1.
Пакеты
rabbitmq
>= 3.13.0, < 3.13.15
3.13.15
rabbitmq
>= 4.0.0, < 4.0.20
4.0.20
rabbitmq
>= 4.1.0, < 4.1.11
4.1.11
rabbitmq
>= 4.2.0, < 4.2.6
4.2.6
rabbitmq
>= 4.3.0, < 4.3.1
4.3.1