Fluent Bit is a popular logging and metrics solution for Windows, Linux, and macOS, embedded in major Kubernetes distributions, including those from Amazon AWS, Google GCP, and Microsoft Azure.
As of March 2024, Fluent Bit has been downloaded and deployed over 13 billion times, a significant increase from the 3 billion downloads reported in October 2022.
Fluent Bit is also used by cybersecurity companies such as Crowdstrike and Trend Micro, as well as many tech giants like Cisco, VMware, Intel, Adobe, and Dell.
A critical vulnerability in Fluent Bit that can be exploited for denial-of-service and remote code execution attacks affects many major cloud providers and numerous technology giants.
While unauthenticated attackers can easily exploit this security flaw to trigger denial-of-service or remotely capture sensitive information, they can also use it to achieve remote code execution if the right conditions and sufficient time are available to create a reliable exploit.
Security researchers stated: “While such heap buffer overflows are known to be exploitable, creating a reliable exploit is not only difficult but also very time-consuming.”
Researchers believe that the most direct and significant risks are those related to the ease of DoS and information leakage.
Patch Included in Fluent Bit 3.0.4
Tenable reported this security vulnerability to the vendor on April 30 and submitted a patch to the main branch of Fluent Bit on May 15. The official version containing this patch is expected to be released alongside Fluent Bit 3.0.4.
Tenable also notified Microsoft, Amazon, and Google of this critical security vulnerability through its vulnerability disclosure platform on May 15.
Before the patch is available on all affected platforms, customers deploying this logging utility on their own infrastructure can mitigate the issue by restricting access to the Fluent Bit monitoring API for authorized users and services.
Users can also disable this vulnerable API endpoint to ensure that any potential attacks are blocked and to eliminate the attack surface.
References and Sources:
https://www.bleepingcomputer.com/news/security/critical-fluent-bit-flaw-impacts-all-major-cloud-providers/
Original Source: 嘶吼专业版“Submission Contact: 010-82992251 [email protected]”
