MQTT Broker Resource Leak via Malformed CONNECT Packets

Executive Summary

This vulnerability involves the sol MQTT broker failing to fully release resources when handling malformed or duplicate CONNECT packets. Instead of properly closing sessions, it may silently drop connections or send a CONNACK while leaving TCP sessions open. This creates half-open connections that consume memory and file descriptors indefinitely.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusually high numbers of active TCP connections to the MQTT broker port (default 1883). Use netstat -an | grep 1883 to check for half-open connections. Check system memory usage with free -m or top for abnormal consumption. Inspect MQTT broker logs for repeated failed CONNECT attempts or CONNACK responses without proper session closure.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to create many half-open connections, consuming system resources like memory and file descriptors. This may trigger the Linux OOM killer, causing the sol process to terminate and resulting in a denial of service for legitimate clients.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service (DoS) attacks that disrupt service availability. GDPR requires data processing systems to ensure availability and resilience, while HIPAA mandates safeguards against unauthorized access or disruptions. A DoS condition may violate these requirements by degrading or halting system functionality.

Useful 0 Not Useful 0

Mitigation Strategies

Update the sol MQTT broker to the latest version that fixes this issue. Configure firewall rules to limit connection rates to the MQTT port. Disable anonymous connections if not required and enforce strong authentication. Monitor system resources closely and set up alerts for abnormal memory or file descriptor usage.

Useful 0 Not Useful 0