Netdata v2.10.4 Security Update: Fixes Buffer Overflow, TOCTOU Race, and API Access Control

Netdata v2.10.4 Security Update Summary Vulnerability Overview This update (v2.10.4) is a patch release primarily addressing multiple security vulnerabilities and stability issues discovered since v2.10.3. Key areas of concern include memory safety, race conditions, and logical flaws in the database engine, streaming, cloud connectivity, and collectors. Scope of Impact Core Components: Database engine, streaming replication, cloud connectivity (ACLK), alerting system, and machine learning modules. Plugins and Collectors: , , , , and driver-related components. API Interfaces: endpoint. Operating Systems: macOS (hardware sensor collectors), Windows (installer), Linux (general). Fixes (Key Security Fixes) 1. Database Engine and Metadata Hardcoded OBEIGNE: Added extended size and uncompressed page boundary verification, SIGBUS protection, and header offset checks for corrupted or truncated data files. Deadlock Diagnostics: Improved error handling for journal file access in deadlock diagnostics. Race Condition Fixes: Fixed page cache races in and , as well as dimension creation deadlocks and virtual node takeover crashes. SQL Injection/Crash Protection: Validated data loaded from SQL to prevent crashes caused by database corruption, and improved UUID handling and error reporting within SQL functions. Null Pointer Protection: Fixed null root index issues in chart lookups to avoid null reference crashes. 2. Streaming and Replication Memory Allocation: Fixed unaligned memory allocation issues in replication queries. Counter Leaks: Fixed sender replication counter leaks on orphaned charts. Frame Handling: Tracked oversized ZSTD frames and handled decompression errors gracefully (logging and disconnecting, rather than calling ). 3. Cloud Connectivity (ACLK) CPU Spinning: Prevented rare, unbounded single-core CPU spinning in the cloud connection loop. Uninitialized Memory: Avoided issues where remained uninitialized upon publish failure. 4. Alerting and Machine Learning Deadlock Fix: Limited waiting during alert notification execution to prevent stuck scripts from blocking the clock process. Data Corruption Protection: Added safeguards against ML database corruption and simplified the recovery process. 5. Collectors Memory Retention: Fixed memory retention issues after queries. Buffer Overflow: Fixed buffer overflows and counter issues in (platform-specific). Integer Overflow: Fixed integer overflows and watchdog underflows in . XML Parsing: Fixed rendering crashes (strict checks, safe XML parsing, 580-byte variable-length handling). Hardware Detection: Fixed variable-length handling for drivers and SMI output. Path Traversal/Injection: Moved the fault detection path to 's (to prevent potential path issues). Race Conditions: Fixed plugin scanning races in the plugin and added slot boundary checks. 6. Security and API API Access Control: The endpoint is now gated by (replacing ), enforcing connection whitelisting and blocking anonymous state change requests. JSON Injection: Fixed an issue where the output format generated invalid JSON when passing . 7. Core Stability and Memory Safety TOCTOU Race: Fixed the TOCTOU race condition in . Allocator Race: Fixed ARAL allocator races and double-free vulnerabilities. Memory Leaks: Fixed memory leaks in and added null pointer guards. Concurrency Bugs: Fixed multiple memory safety and concurrency bugs identified by Coverity and Sonar audits. Shutdown Robustness: Fixed SIGSEGV in and pipeline cleanup handling under ENOENT conditions. 8. Installation and Packaging Windows Installer: Adjusted installer logic to only run claiming when a token and room are provided, added wide character handling to fix HTTP client crashes, and fixed Visual Studio toolchain search. Netdata-updater: Improved error handling during file retrieval and silenced output. --- Note: The page does not include specific POC code or exploit code, only fix descriptions and related Issue/PR links.

Goal Reached Thanks to every supporter — we hit 100%!

Netdata v2.10.4 Security Update: Fixes Buffer Overflow, TOCTOU Race, and API Access Control

More from this source