Denial-of-Service in HashiCorp memberlist

Impact Analysis

This vulnerability can lead to a denial-of-service condition on affected nodes by exhausting their memory resources.

An attacker with network access to the gossip port can cause the affected process to terminate, potentially disrupting services that rely on memberlist, Consul, or Nomad.

If gossip encryption is disabled (which is the default), the attacker does not need to authenticate to exploit this vulnerability, increasing the risk.

Enabling gossip encryption can mitigate unauthenticated exploitation but does not remove the underlying vulnerability.

Useful 0 Not Useful 0

Executive Summary

HashiCorp memberlist versions before 0.6.0 have a denial-of-service (DoS) vulnerability in their gossip message handling. An attacker with network access to the gossip port can send specially crafted messages that falsely declare very large values for node count and user state size.

This causes the receiving node to try to allocate excessive amounts of memory, which can exhaust the node's memory resources and cause the process to terminate unexpectedly.

The vulnerability affects memberlist up to version 0.5.4 and is fixed in version 0.6.0.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying if your system is running HashiCorp memberlist versions up to 0.5.4 or affected versions of Consul and Nomad that embed memberlist. Specifically, check the version of memberlist or the embedded versions in Consul and Nomad.

To detect potential exploitation attempts on your network, monitor traffic on the gossip port for unusually large or malformed gossip messages that declare falsely large node counts or user state sizes.

Suggested commands to check installed versions:

• For memberlist: `memberlist --version` or check the version in your deployment manifests or binaries.
• For Consul: `consul version`
• For Nomad: `nomad version`

To monitor network traffic on the gossip port (default 7946), you can use tools like tcpdump or Wireshark to capture and analyze packets for suspiciously large gossip messages.

• Example tcpdump command: `tcpdump -i <interface> port 7946 -w gossip_traffic.pcap`
• Then analyze the capture with Wireshark or similar tools to look for abnormal message sizes.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading to the fixed versions: memberlist 0.6.0, Consul 2.0.2, or Nomad 2.0.4 or later.

If upgrading immediately is not possible, enabling gossip encryption can mitigate unauthenticated exploitation since the vulnerability does not require authentication only when gossip encryption is disabled (which is the default).

Additionally, monitor network traffic on the gossip port for suspicious activity and consider restricting network access to the gossip port to trusted sources only.

Useful 0 Not Useful 0