Resource management error in Narayana - CVE-2024-8447

Vulnerability identifier: #VU106934

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-8447

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources in the LRA Coordinator component. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash.

Narayana
JBoss Enterprise Application Platform
eap8-slf4j (Red Hat package)
eap8-netty (Red Hat package)
eap8-netty-transport-native-epoll (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-eap-product-conf-parent (Red Hat package)

Install updates from vendor's website.

Narayana - update to 7.1.0
JBoss Enterprise Application Platform - update to 8.0.6
eap8-slf4j (Red Hat package) - addressed in versions 2.0.16-2.redhat_00003.1.el8eap, 2.0.16-2.redhat_00003.1.el9eap
eap8-netty (Red Hat package) - addressed in versions 4.1.119-1.Final_redhat_00002.1.el8eap, 4.1.119-1.Final_redhat_00002.1.el9eap
eap8-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.119-1.Final_redhat_00002.1.el8eap, 4.1.119-1.Final_redhat_00002.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.6-15.GA_redhat_00009.1.el8eap, 8.0.6-15.GA_redhat_00009.1.el9eap
eap8-eap-product-conf-parent (Red Hat package) - addressed in versions 800.6.1-1.GA_redhat_00001.1.el8eap, 800.6.1-1.GA_redhat_00001.1.el9eap

• https://bugzilla.redhat.com/show_bug.cgi?id=2335206
• https://github.com/jbosstm/narayana/pull/2293
• https://issues.redhat.com/browse/JBTM-3911

• Denial of service in Narayana
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0