Heap Out-of-Bounds Write in Wazuh Agent OS Parsing

Executive Summary

This vulnerability exists in Wazuh versions from 4.0.0 up to but not including 4.14.4, specifically in the parse_uname_string() function within remoted_op.c. The function processes OS identification data from agents and contains a dangerous code pattern where it writes to strlen(ptr) - 1 without checking if the string is empty.

If the string is empty, strlen() returns 0, and subtracting 1 causes an unsigned integer underflow, wrapping to SIZE_MAX. This results in a write occurring one byte before the allocated buffer, corrupting heap metadata such as the chunk size field used by glibc malloc. This heap corruption can lead to unstable behavior or exploitation.

The issue was fixed in Wazuh version 4.14.4.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability manifests when the Wazuh manager processes malformed agent OS identification data, specifically in the parse_uname_string() function. Detection involves monitoring for crashes or heap corruption symptoms triggered by malformed keep-alive messages from agents.

Since the vulnerability is triggered by crafted keep-alive messages, network monitoring tools can be used to inspect agent communication for unusual or malformed uname data.

No specific detection commands are provided in the resources, but general approaches include:

• Monitoring Wazuh manager logs for crashes or heap corruption errors.
• Using network packet capture tools (e.g., tcpdump, Wireshark) to analyze agent keep-alive messages for malformed OS identification strings.
• Checking the Wazuh manager version to identify if it is below 4.14.4, which is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to heap corruption due to out-of-bounds writes occurring before the allocated buffer. Heap corruption can cause application crashes, instability, or potentially allow an attacker to execute arbitrary code or escalate privileges.

Since the vulnerability affects a component that processes OS identification data from agents, an attacker who can control or influence this input might exploit the flaw to compromise the Wazuh system.

The CVSS v3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacting availability.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Wazuh to version 4.14.4 or later, where the heap-based out-of-bounds write issue in parse_uname_string() has been patched.

Useful 0 Not Useful 0