CyberRota Analysis
AI-GeneratedThe mmpstrucdata plugin in Rsyslog versions 7.5.4 to 8.2606.0 is vulnerable to a stack buffer overflow due to improper handling of RFC5424 parameter values, allowing remote unauthenticated attackers to exploit this flaw if the MaxMessageSize setting permits oversized messages. This vulnerability can lead to a crash and disruption of log collection, making it critical for organizations using Rsyslog with the mmpstrucdata plugin to prioritize upgrading to version 8.2606.0 or later. Users who do not utilize this plugin or maintain message size limits below the threshold are not affected.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE without supplying the destination size. A remote unauthenticated attacker whose crafted RFC5424 message reaches an action using mmpstrucdata can provide a structured-data parameter larger than that buffer when MaxMessageSize permits it, causing an attacker-controlled stack overwrite. Deployments that do not install and use the plugin, or whose effective message-size limit remains below the required threshold, are not affected by this issue. The demonstrated impact is a crash and interruption of log collection; code execution is not demonstrated. This issue is fixed in version 8.2606.0.