-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/elastic/beats | go | >= 8.6.0, < 8.19.9 | 8.19.9 |
| github.com/elastic/beats | go | >= 9.0.0, < 9.1.9 | 9.1.9 |
| github.com/elastic/beats | go | >= 9.2.0, < 9.2.3 | 9.2.3 |
| github.com/elastic/beats/v7 | go | < 7.0.0-alpha2.0.20251209162832-28cfc80d2f4e | 7.0.0-alpha2.0.20251209162832-28cfc80d2f4e |
Miggo AIRoot Cause AnalysisThe vulnerability lies in Packetbeat's IPv4 fragment reassembly logic, which could be exploited to cause a denial-of-service through memory and CPU exhaustion. The root cause was in the decoder.fragmentCache.add function, which lacked critical bounds checks. An unauthenticated remote attacker could send a stream of crafted IPv4 fragments that would be stored in a cache without any limits on the number of fragment sets or the number of fragments per set. The cache was also keyed only by the 16-bit fragment ID, making it possible for an attacker to cause hash collisions and inject fragments into reassembly queues for legitimate traffic.
The decoder.Decoder.OnPacket function serves as the entry point for this vulnerability, as it's the top-level function that receives and processes the malicious packets before passing them to the flawed add method. Furthermore, the old decoder.fragmentCache.purge function had an inefficient garbage collection mechanism, which worsened the memory leak by failing to clean up stale fragments in a timely manner.
The patch addresses these issues by:
fragmentMaxSets, fragmentMaxPerFlow, ipMaxLength) within the add function to cap memory usage.fragmentKey) that includes source/destination IP, protocol, and ID, thus preventing cross-flow fragment injection.purge logic with a more efficient maybePurge function that runs periodically, ensuring timely cleanup of expired fragments.decoder.fragmentCache.addpacketbeat/decoder/decoder.go
decoder.Decoder.OnPacketpacketbeat/decoder/decoder.go
decoder.fragmentCache.purgepacketbeat/decoder/decoder.go
A Semantic Attack on Google Gemini - Read the Latest Research