### 关键信息 #### CVE 编号 CVE-2024-42649 #### 漏洞类型 内存泄漏 #### 漏洞版本 - NanoMQ 0.22.1 - GIT COMMIT: 70de56cddc87444d120a3a7e477c76a26bca8d56 #### 漏洞影响 此漏洞允许远程客户端通过发送特制的 MQTT 数据包触发 NanoMQ 版本 0.22.1 中的内存泄漏。在接收和处理恶意输入时，代理会分配堆内存但不会释放，导致内存消耗逐渐增加。此内存泄漏可以反复触发而无需身份验证，最终可能导致资源耗尽和长期部署中的拒绝服务（DoS）。 #### 函数堆栈信息 ```plaintext ==38615==ERROR: LeakSanitizer: detected memory leaks Direct leak of 368 byte(s) in 1 object(s) allocated from: #0 0x7f0c31d2fa60 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:143 #1 0x5559e340888f in nni_zalloc /home/songxiangpu/Documents/GitRepository/nanomq/ngg/src/platform/posix_alloc.c:20 #2 0x5559e33ee3ed in mqtt_msg_new /home/songxiangpu/Documents/GitRepository/nanomq/ngg/src/sp/transport/mqtt/core/message.c:408 #3 0x5559e351567c in tcpipran_pipe_recv_cb /home/songxiangpu/Documents/GitRepository/nanomq/ngg/src/sp/transport/mqtt/broker_tcp.c:744 #4 0x5559e34055fe in nni_taskq_thread /home/songxiangpu/Documents/GitRepository/nanomq/ngg/src/core/taskq.c:47 #5 0x5559e340895f in nni_plat_thread_main /home/songxiangpu/Documents/GitRepository/nanomq/ngg/src/platform/posix/posix_thread.c:266 #6 0x7f0c31c07008 in start_thread (/build/glibc-LicZbx/glibc-2.31/nptl/pthread_create.c:477 Indirect leak of 255 byte(s) in 2 object(s) allocated from: #0 0x7f0c31d2fa60 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:143 #1 0x5559e340888f in nni_zalloc /home/songxiangpu/Documents/GitRepository/nanomq/ngg/src/platform/posix_alloc.c:26 #2 0x5559e33ee3ed in nni_chunk_grow /home/songxiangpu/Documents/GitRepository/nanomq/ngg/src/core/message.c:158 #3 0x5559e33ee3ed in nni_msg_alloc /home/songxiangpu/Documents/GitRepository/nanomq/ngg/src/sp/transport/mqtt/core/message.c:188 #4 0x5559e351567c in tcpipran_pipe_recv_cb /home/songxiangpu/Documents/GitRepository/nanomq/ngg/src/sp/transport/mqtt/broker_tcp.c:744 #5 0x5559e34055fe in nni_taskq_thread /home/songxiangpu/Documents/GitRepository/nanomq/ngg/src/core/taskq.c:47 #6 0x5559e340895f in nni_plat_thread_main /home/songxiangpu/Documents/GitRepository/nanomq/ngg/src/platform/posix/posix_thread.c:266 #7 0x7f0c31c07008 in start_thread (/build/glibc-LicZbx/glibc-2.31/nptl/pthread_create.c:477 SUMMARY: AddressSanitizer: 255 byte(s) leaked in 2 allocation(s). ``` #### 复现步骤 ```bash nanomq start --conf .../etc/nanomq.conf nc 127.0.0.1 1883 < ./poc.raw ```