Kafka-Python Protocol Parser DoS via Malicious Frame Length

Detection Guidance

This vulnerability can be detected by monitoring for symptoms such as hung connections, stalled requests, or consumers that stop heartbeating, which indicate that the kafka-python client is in a broken state due to the denial-of-service attack.

Since the vulnerability involves receiving a specially crafted 4-byte frame length that triggers excessive memory allocation or uncaught exceptions, network traffic analysis tools can be used to inspect Kafka protocol frames for abnormal or unusually large frame length values.

While no specific commands are provided in the resources, general detection steps could include:

• Using packet capture tools like tcpdump or Wireshark to capture Kafka traffic and filter for frames with suspiciously large length fields.
• Monitoring application logs for uncaught ValueError exceptions or connection hang events related to kafka-python.
• Checking for kafka-python versions prior to 2.3.2 in your environment, as these are vulnerable.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in kafka-python versions prior to 2.3.2 within the protocol parser. It allows a malicious broker or a machine-in-the-middle attacker to cause a denial-of-service by sending a specially crafted 4-byte frame length value that lacks proper bounds validation.

This crafted frame length, when processed by the receive_bytes() function, can trigger either a very large memory allocation (multi-gigabyte) or an uncaught ValueError. Both outcomes cause the connection to hang or break, leading to requests stalling and consumers stopping their heartbeats until the application is restarted.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing denial-of-service conditions in your kafka-python client applications.

• Memory exhaustion due to large allocations triggered by malicious frame lengths.
• Connections hanging or breaking because of uncaught errors, leading to stalled requests.
• Consumers stopping their heartbeat signals, which can disrupt message consumption until the client is restarted.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

The primary immediate mitigation step is to upgrade kafka-python to version 2.3.2 or later, where the vulnerability has been patched by adding proper validation of frame lengths and SASL/SCRAM iteration counts.

If upgrading immediately is not possible, consider monitoring and restricting network traffic to trusted Kafka brokers only, to reduce the risk of malicious frame injection.

Additionally, restarting affected kafka-python clients can temporarily restore functionality if they have entered a broken state due to this vulnerability.

Useful 0 Not Useful 0