CVE-2014-3634

What it actually does

Out-of-bounds array access triggered by a crafted PRI value in incoming syslog messages, resulting in memory corruption that can cause a crash or enable arbitrary code execution.

Why it matters to the business

Logging infrastructure on exposed systems can be disrupted or fully compromised, leading to loss of audit trails, potential lateral movement, and operational downtime on servers running the affected logging daemons.

How an attack unfolds

An attacker sends a network packet containing a malformed syslog message with an out-of-range PRI value to a listening rsyslog or sysklogd instance; the daemon performs an unchecked array access that corrupts memory and allows the attacker to crash the process or execute code.

How to fix it

Upgrade rsyslog to version 7.6.6 or later and 8.4.1 or later; replace or upgrade sysklogd to a maintained fork that addresses the array bounds issue. Disable network reception of syslog messages where feasible until patches are applied.

How to confirm the fix worked

Verify installed package versions against the fixed releases, review daemon startup logs for the absence of the vulnerable code path, and test with a non-malicious PRI value to confirm normal operation.

Typical attack path

1. Scan for hosts listening on UDP/TCP syslog ports (514).
2. Craft a syslog packet with an invalid PRI integer value.
3. Transmit the packet to the target daemon.
4. Trigger out-of-bounds read/write that crashes the process or yields code execution.

How to detect it

Review rsyslog and sysklogd crash dumps or core files, inspect syslog reception logs for malformed PRI entries, and correlate any sudden daemon restarts with inbound network traffic on port 514.

What your security team should do

• Immediately restrict syslog listeners to trusted sources via firewall rules.
• Prioritize patching or replacement of affected logging packages on all internet-facing or high-value systems.
• Monitor for new exploit code leveraging the publicly available proof-of-concept and update detection rules accordingly.