Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-8185

CVE-2024-8185:
Hashicorp Vault vulnerable to denial of service through memory exhaustion

7.5

CVSS Score

Basic Information

CVE ID
CVE-2024-8185
GHSA ID
GHSA-g233-2p4r-3q7v
EPSS Score
-
CWE
CWE-636
Published
10/31/2024
Updated
10/31/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/hashicorp/vaultgo>= 1.2.0, < 1.18.11.18.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from two key issues: 1) The raft bootstrap challenge handler (handleRaftBootstrapChallengeWrite) lacked rate limiting and used non-expiring storage, allowing attackers to flood the system with challenges. 2) The sync.Map implementation in Core.pendingRaftPeers had no memory limits. The fix introduced an LRU cache with size constraints (RaftInitialChallengeLimit) and rate limiting via golang.org/x/time/rate, directly addressing these memory exhaustion vectors. The commit diff shows the transition from sync.Map to LRU and the addition of challenge limits in these components.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

V*ult *ommunity *n* V*ult *nt*rpris* (“V*ult”) *lust*rs usin* V*ult’s Int**r*t** Stor*** ***k*n* *r* vuln*r**l* to * **ni*l-o*-s*rvi** (*oS) *tt**k t*rou** m*mory *x**ustion t*rou** * R**t *lust*r join *PI *n*point. *n *tt**k*r m*y s*n* * l*r** volum

Reasoning

T** vuln*r**ility st*mm** *rom two k*y issu*s: *) T** r**t *ootstr*p ***ll*n** **n*l*r (**n*l*R**t*ootstr*p***ll*n**Writ*) l**k** r*t* limitin* *n* us** non-*xpirin* stor***, *llowin* *tt**k*rs to *loo* t** syst*m wit* ***ll*n**s. *) T** syn*.M*p imp