CVE-2024-23337

What it actually does

Integer overflow triggered by assigning a value at index 2147483647 in jq versions up to 1.7.1, resulting in memory corruption that causes a denial of service.

Why it matters to the business

Disrupts JSON processing pipelines, automation scripts, and data handling tools across Linux environments, potentially halting operations that depend on jq for parsing or transformation.

How an attack unfolds

An attacker supplies a crafted JSON input or jq expression using the maximum signed 32-bit integer index to trigger the overflow in the assignment logic, leading to a crash without requiring authentication or special privileges.

How to fix it

Upgrade jq to the patched commit de21386681c0df0104a99d9d09db23a9b2a78b1e or apply the corresponding fixed Ubuntu packages such as linux 3.11.0-12.19, linux-aws 4.4.0-1002.2, or linux-aws-5.4 5.4.0-1135.145~18.04.1 depending on the distribution variant.

How to confirm the fix worked

Confirm jq version is newer than 1.7.1 or matches the listed fixed package versions; test by attempting assignment at index 2147483647 and verifying no crash occurs.

Typical attack path

1. Identify systems or scripts invoking jq on untrusted or attacker-controlled input
2. Craft a JSON payload or expression containing the index value 2147483647
3. Invoke jq with the malicious input via command line or piped data
4. Trigger integer overflow during value assignment, causing process termination

How to detect it

Monitor system and application logs for jq process crashes, segmentation faults, or abrupt terminations when processing JSON; review command history or audit logs for invocations involving large numeric indices.

• jq process segmentation fault
• integer overflow in jq assignment
• abnormal termination of jq on JSON input

What your security team should do

• Immediately update all instances of jq and dependent Ubuntu packages to the specified fixed versions
• Scan environments for outdated jq binaries and prioritize patching where jq processes untrusted input
• Implement input validation or sandboxing around jq invocations until upgrades are complete