Null pointer dereference in ngx_chain_to_iovec() in NGINX Open Source - CVE-2016-4450

 

Null pointer dereference in ngx_chain_to_iovec() in NGINX Open Source - CVE-2016-4450

Published: June 24, 2016 / Updated: May 31, 2023


Vulnerability identifier: #VU25
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-4450
CWE-ID: CWE-829
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause denial of service conditions on the target system.

The vulnerability exists due to an access control error in the ngx_chain_to_iovec() function, when saving the client request body to a temporary file. A remote unauthenticated attacker can cause a null pointer dereference in the ngx_chain_to_iovec() function by sending specially crafted data.

Successful exploitation of this vulnerability may lead to the crash of a worker process.


Affected software

NGINX Open Source
Arch Linux
Debian Linux
Amazon Linux AMI
Fedora
Ubuntu
Junos OS
nginx (Alpine package)
nginx
rh-nginx18-nginx (Red Hat package)
PowerFlex rack

How to mitigate CVE-2016-4450

The vendor has issued a fix (1.10.1, 1.11.1).

Patch for nginx 1.9.13 - 1.11.0 can be found here:

http://nginx.org/download/patch.2016.write.txt

Patch for older nginx versions (1.3.9 - 1.9.12):

http://nginx.org/download/patch.2016.write2.txt


NGINX Open Source - addressed in versions 1.10.1, 1.11.1
nginx (Alpine package) - update to 1.6.2-r2
Junos OS - addressed in versions 21.4R3-S8, 22.2R3-S5, 22.3R3-S3, 22.4R3-S4, 23.2R2-S2, 23.4R2-S1, 24.2R1
nginx - addressed in versions 1.6.3-9.el7, 1.8.1-2.fc23, 1.8.1-3.fc23, 1.10.1-1.el5, 1.10.1-1.el6, 1.10.1-1.fc24
rh-nginx18-nginx (Red Hat package) - addressed in versions 1.8.1-1.el6, 1.8.1-1.el7
PowerFlex rack - update to 3.6.6.0

External References

Related Security Bulletins