Cloudanix VulnDB

CVE-2024-42331

None

CVSS

—

EPSS

0.3%

Published

Nov 27, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in monitoring software can let attackers crash systems or run harmful code by tricking it into using memory it has already cleaned up.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Theoretical
Impact
Other
Component
Library
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free occurs when a heap pointer from the Duktape JavaScript engine, retrieved in es_browser_ctor, is dereferenced in browser_push_error after garbage collection frees the wd->browser pointer.

Why it matters to the business

Attackers may crash monitoring processes or execute arbitrary code on affected Linux systems, disrupting infrastructure visibility and requiring emergency patching of widely deployed older distributions.

How an attack unfolds

An attacker supplies crafted JavaScript to the embed browser component; garbage collection frees the browser heap object; subsequent error path code reuses the dangling pointer, enabling memory corruption that can be chained for code execution.

How to fix it

Upgrade affected packages to the listed fixed versions: linux 3.13.0-101.148, linux-aws 4.4.0-1002.2, linux-lts-xenial 4.4.0-47.68~14.04.1, linux 4.4.0-47.68, linux-aws 4.4.0-1001.10, linux-gke 4.4.0-1003.3, linux-hwe 4.8.0-36.36~16.04.1, linux-raspi2 4.4.0-1038.45, linux-snapdragon 4.4.0-1035.39, linux-lts-vivid 3.19.0-74.82~14.04.1.

How to confirm the fix worked

Verify package versions match the fixed releases above; recompile or restart services and confirm absence of the browser.c / browser_error.c pointer handling pattern in running binaries.

Typical attack path

  1. Locate exposed Zabbix server or agent with embed browser feature enabled
  2. Deliver malicious JavaScript payload through monitored item or script
  3. Trigger garbage collection to free the browser object
  4. Force error handling path to dereference the freed pointer
  5. Leverage resulting memory corruption for denial of service or code execution

How to detect it

Review Zabbix process crash logs, core dumps containing freed browser objects, and audit trails of JavaScript execution in embed contexts for signs of prior memory corruption attempts.

What your security team should do

  • Apply the exact fixed kernel packages immediately given the 684-day exposure window
  • Disable embed browser functionality where not required
  • Monitor for memory corruption indicators in Zabbix processes
  • Scan all Ubuntu 14.04/16.04 instances for the listed vulnerable packages

The record

In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error method in the src/libs/zbxembed/browser_error.c file. A use-after-free bug can occur at this stage if the wd->browser heap pointer is freed by garbage collection.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 zabbix 0 1:5.0.45+dfsg-1+deb11u1
Debian:12 zabbix 0 No fix
Debian:13 zabbix 0 1:7.0.5+dfsg-1
Ubuntu:20.04:LTS zabbix 0 No fix
Ubuntu:22.04:LTS zabbix 0 No fix
Ubuntu:24.10 zabbix 0 No fix
Ubuntu:Pro:14.04:LTS zabbix 0 No fix
Ubuntu:Pro:16.04:LTS zabbix 0 No fix
Ubuntu:Pro:18.04:LTS zabbix 0 No fix
Ubuntu:Pro:20.04:LTS zabbix 0 No fix
Ubuntu:Pro:22.04:LTS zabbix 0 No fix

Related vulnerabilities