Denial of Service in Red Hat Service Interconnect

Executive Summary

This vulnerability is in the skupper-router component of Red Hat Service Interconnect, which enables secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to unbounded recursion during parsing, the router can exhaust stack memory and crash, causing a denial of service for the interconnected network.

Useful 0 Not Useful 0

Detection Guidance

Monitor skupper-router logs for crashes or stack overflow errors during message processing. Check for unusually deep AMQP message nesting in network traffic using packet inspection tools like tcpdump or Wireshark. Look for repeated failed connection attempts from internal nodes.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a valid x.509 certificate signed by the internal network's certificate authority could exploit this flaw by sending malicious messages. This would crash the skupper-router process, terminating all active connections and preventing new traffic routing through the affected node, leading to network downtime.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade skupper-router to a patched version that includes recursion depth limits in the AMQP parser. If upgrading is not possible, restrict network access to the router using firewalls to limit exposure to trusted internal nodes only.

Useful 0 Not Useful 0