CVE-2017-10906
published 2017-12-08CVE-2017-10906: Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary…
PriorityP260critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
4.58%
90.6th percentile
Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cloud_native_computing_foundation | fluentd | — | — |
| fluentd | fluentd | — | — |
| fluentd | fluentd | — | — |
| fluentd | fluentd | — | — |
| fluentd | fluentd | — | — |
| fluentd | fluentd | — | — |
| fluentd | fluentd | — | — |
| fluentd | fluentd | — | — |
| fluentd | fluentd | — | — |
| fluentd | fluentd | — | — |
| fluentd | fluentd | — | — |
| fluentd | fluentd | — | — |
| fluentd | fluentd | — | — |
| fluentd | fluentd | >= 0.12.29 < 0.12.41 | 0.12.41 |
| linux | linux_kernel | >= 0 < 4.4.0-166.195 | 4.4.0-166.195 |
| redhat | openstack | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerable code path is in filter_parser.rb:filter_stream — monitor for escape sequence injection in log output processed by this function ↗
- →Exploitation requires filter_parser to be enabled in fluentd.conf — audit fluentd configurations for filter_parser usage as a detection/triage step ↗
- →Exploitation requires Fluentd running in non-daemon mode — detect fluentd processes running in foreground/non-daemon mode as a risk indicator ↗
- →Attack vector is a specially crafted log entry containing escape sequences — inspect ingested log content for terminal escape sequences (e.g. ESC [ sequences) as anomaly indicators ↗
- ·All three preconditions must be simultaneously present for exploitation: (1) filter_parser enabled, (2) non-daemon mode or unsanitised syslog, (3) vulnerable terminal interacting with fluentd output — absence of any one prevents exploitation ↗
- ·rsyslog sanitises escape sequences and is therefore not a viable attack path via syslog — deployments using rsyslog as the syslog server are not exposed through that vector ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv7.0HIGH
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Fluentd Escape Sequence Injection Vulnerability
ghsa·2022-05-13
CVE-2017-10906 [CRITICAL] Fluentd Escape Sequence Injection Vulnerability
Fluentd Escape Sequence Injection Vulnerability
Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
OSV
Fluentd Escape Sequence Injection Vulnerability
osv·2022-05-13
CVE-2017-10906 [CRITICAL] Fluentd Escape Sequence Injection Vulnerability
Fluentd Escape Sequence Injection Vulnerability
Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
OSV
linux-lts-xenial, linux-aws vulnerabilities
osv·2019-10-23·CVSS 7.0
CVE-2016-10906 linux-lts-xenial, linux-aws vulnerabilities
linux-lts-xenial, linux-aws vulnerabilities
USN-4163-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 ESM.
It was discovered that a race condition existed in the ARC EMAC ethernet
driver for the Linux kernel, resulting in a use-after-free vulnerability.
An attacker could use this to cause a denial of service (system crash).
(CVE-2016-10906)
It was discovered that a race condition existed in the Serial Attached SCSI
(SAS) implementation in the Linux kernel when handling certain error
conditions. A local attacker could use this to cause a denial of service
(kernel deadlock). (CVE-2017-18232)
It was discovered that the RSI 91x Wi-Fi driver i
OSV
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
osv·2019-10-22·CVSS 7.0
CVE-2016-10906 linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that a race condition existed in the ARC EMAC ethernet
driver for the Linux kernel, resulting in a use-after-free vulnerability.
An attacker could use this to cause a denial of service (system crash).
(CVE-2016-10906)
It was discovered that a race condition existed in the Serial Attached SCSI
(SAS) implementation in the Linux kernel when handling certain error
conditions. A local attacker could use this to cause a denial of service
(kernel deadlock). (CVE-2017-18232)
It was discovered that the RSI 91x Wi-Fi driver in the Linux kernel did not
did not handle detach operations correctly, leading to a use-after-free
vulnerability. A physically proximate attacker could use this to cause a
denial of
Red Hat
fluentd: Escape sequence injection in filter_parser.rb:filter_stream can lead to arbitrary command execution when processing logs
vendor_redhat·2017-11-07·CVSS 9.8
CVE-2017-10906 [CRITICAL] CWE-138 fluentd: Escape sequence injection in filter_parser.rb:filter_stream can lead to arbitrary command execution when processing logs
fluentd: Escape sequence injection in filter_parser.rb:filter_stream can lead to arbitrary command execution when processing logs
Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
Statement: This flaw requires particular preconditions to be exploitable, which are not common in supported deployments of fluentd. The vulnerable system must have all of:
1. A filter_parser enabled in fluentd.conf
2. Fluentd running in non-daemon mode or a bad syslog server that doesn't sanitise escape sequences (rsyslog does)
3. A vulnerable terminal that happens to be running fluentd or manipulating the fluentd log file (for example tailing it)
This issue affe
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2018:2225https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixeshttps://github.com/fluent/fluentd/pull/1733https://jvn.jp/en/vu/JVNVU95124098/index.htmlhttps://access.redhat.com/errata/RHSA-2018:2225https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixeshttps://github.com/fluent/fluentd/pull/1733https://jvn.jp/en/vu/JVNVU95124098/index.html
2017-12-08
Published