CVE-2019-6250

Vulnerability

A pointer overflow vulnerability exists in ZeroMQ libzmq versions 4.2.x and 4.3.x before 4.3.1. In src/v2_decoder.cpp, the zmq::v2_decoder_t::size_ready() function inadequately validates a peer-supplied msg_size_ value. A very large value causes a pointer overflow in the comparison, allowing an attacker to bypass bounds checking and write arbitrary data beyond the allocated buffer. The issue is present since v4.2.0; older releases are not affected [1][2].

Exploitation

An authenticated attacker can send a crafted message with an excessively large msg_size_ value. This causes an integer overflow in the pointer arithmetic during the bounds check, which evaluates as false even though the data does not fit in the buffer. Consequently, libzmq copies attacker-supplied bytes directly into memory beyond the intended buffer. The attacker must know valid memory addresses for code execution, so ASLR provides mitigation. The attack requires authentication; peers behind CURVE/GSSAPI are not vulnerable to unauthenticated attackers [1][2].

Impact

Successful exploitation allows an authenticated attacker to overwrite memory beyond the receive buffer, which is immediately followed by a content_t structure containing function pointers. By overwriting these pointers, the attacker can inject and execute arbitrary OS commands or code on the target system. The attack does not require typical buffer-overflow control flow manipulation due to the memory layout [1].

Mitigation

The vulnerability is fixed in ZeroMQ libzmq version 4.3.1, released on 2019-01-12 [2]. Users should upgrade to 4.3.1 or later. No workaround is available [3]. The flaw is not exploitable without authentication, so enabling CURVE/GSSAPI protection prevents unauthenticated exploitation [2].