Miggo Logo

CVE-2022-31073: KubeEdge Edge ServiceBus module DoS

6.5

CVSS Score
3.1

Basic Information

EPSS Score
0.28529%
Published
7/11/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/kubeedge/kubeedgego>= 1.11.0, < 1.11.11.11.1
github.com/kubeedge/kubeedgego>= 1.10.0, < 1.10.21.10.2
github.com/kubeedge/kubeedgego< 1.9.41.9.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from uncontrolled resource consumption when processing HTTP bodies. The patches consistently add size limitations using http.MaxBytesReader and io.LimitReader across multiple components. Each identified function was modified to constrain request/response body sizes, indicating they previously handled untrusted input without proper size validation. These functions directly process() HTTP message bodies and would appear in stack traces when handling malicious large payloads. The ServiceBus-related functions (processMessage, Forward) are particularly critical as they're explicitly mentioned in the vulnerability description.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** S*rvi***us s*rv*r on t** **** si** m*y ** sus**pti*l* to * *oS *tt**k i* *n *TTP r*qu*st *ont*inin* * v*ry l*r** *o*y is s*nt to it. It is possi*l* *or t** no** to ** *x**ust** o* m*mory. T** *ons*qu*n** o* t** *x**ustion is t**t ot**r

Reasoning

T** vuln*r**ility st*ms *rom un*ontroll** r*sour** *onsumption w**n pro**ssin* *TTP *o*i*s. T** p*t***s *onsist*ntly *** siz* limit*tions usin* `*ttp.M*x*yt*sR****r` *n* `io.LimitR****r` **ross multipl* *ompon*nts. **** i**nti*i** `*un*tion` w*s mo*i