CVE-2024-1023

Summary

A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.

Affected Software

VendorProductVersion RangeStatus
4.4.5affected
4.4.6affected
4.5.0affected
4.5.1affected
Red HatCryostat 2 on RHEL 82.4.0-7 < *unaffected
Red HatCryostat 2 on RHEL 82.4.0-4 < *unaffected
Red HatCryostat 2 on RHEL 82.4.0-4 < *unaffected
Red HatCryostat 2 on RHEL 82.4.0-4 < *unaffected
Red HatCryostat 2 on RHEL 82.4.0-9 < *unaffected
Red HatCryostat 2 on RHEL 82.4.0-4 < *unaffected
Red HatMTA-6.2-RHEL-96.2.3-2 < *unaffected
Red HatRed Hat build of Quarkus 3.2.11.Final4.4.8.redhat-00001 < *unaffected

Weaknesses

  • CWE-401: Missing Release of Memory after Effective Lifetime

Workarounds

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References