CVE-2023-20897: SaltStack Salt DOS Vulnerability

CVE-2023-20897 Overview

CVE-2023-20897 is a Denial of Service (DoS) vulnerability affecting SaltStack Salt masters in versions prior to 3005.2 and 3006.2. The vulnerability exists in the minion return handling mechanism, where an attacker can send specially crafted malicious packets to the request server. When the number of bad packets equals the number of worker threads configured on the master, the Salt master becomes completely unresponsive to all return requests until it is manually restarted.

Critical Impact

Successful exploitation renders the Salt master unresponsive, disrupting infrastructure automation and configuration management across all connected minions until manual intervention restarts the service.

Affected Products

• SaltStack Salt versions prior to 3005.2
• SaltStack Salt versions prior to 3006.2

Discovery Timeline

• 2023-09-05 - CVE CVE-2023-20897 published to NVD
• 2025-02-13 - Last updated in NVD database

Technical Details for CVE-2023-20897

Vulnerability Analysis

This vulnerability is classified under CWE-404 (Improper Resource Shutdown or Release), indicating a flaw in how the Salt master handles resource cleanup when processing malformed network packets. The Salt master utilizes a worker thread pool to process incoming requests from minions. Each worker thread is designed to handle return requests independently, but the vulnerability allows an attacker to exhaust all available worker threads by sending malicious packets.

The attack can be executed remotely over the network without requiring any authentication or user interaction, making it relatively straightforward for attackers with network access to the Salt master. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system.

Root Cause

The root cause lies in improper resource handling within the request server component. When the Salt master receives malformed packets, the worker threads fail to properly release resources or recover from the error state. This resource management flaw (CWE-404) means that each bad packet effectively locks up one worker thread. Once all worker threads are occupied by these stuck operations, no legitimate minion return requests can be processed.

Attack Vector

The attack exploits the network-accessible request server on the Salt master. An attacker sends a series of specially crafted bad packets to the Salt master's request server port. The number of packets required equals the worker thread count configured on the target system (typically a small number, often matching CPU cores). Once executed, the master cannot process any return requests from minions, effectively breaking the Salt infrastructure's command and control capabilities.

The vulnerability mechanism can be understood as follows: When a malformed packet is received by the request server, the worker thread assigned to process it enters a blocked or hung state instead of gracefully handling the error and returning to the available thread pool. This design flaw means that an attacker with knowledge of the worker thread count can systematically disable each thread until none remain available for legitimate operations.

Detection Methods for CVE-2023-20897

Indicators of Compromise

• Salt master becoming unresponsive to minion return requests without corresponding system resource exhaustion
• Unusual network traffic patterns targeting the Salt master request server port
• Worker threads appearing stuck or non-responsive in process monitoring
• Repeated malformed packet requests in Salt master logs from single or multiple sources

Detection Strategies

• Monitor Salt master responsiveness with automated health checks that test return request processing
• Implement network traffic analysis to detect anomalous packet patterns targeting Salt infrastructure
• Configure alerting on Salt master service availability and worker thread utilization
• Review Salt master logs for patterns of malformed or rejected packet handling errors

Monitoring Recommendations

• Set up continuous monitoring for Salt master service availability and response times
• Implement baseline metrics for worker thread activity and alert on deviations
• Deploy network intrusion detection rules for suspicious traffic to Salt master ports
• Establish automated recovery procedures with alerting for unexpected Salt master restarts

How to Mitigate CVE-2023-20897

Immediate Actions Required

• Upgrade SaltStack Salt to version 3005.2 or later for the 3005.x branch
• Upgrade SaltStack Salt to version 3006.2 or later for the 3006.x branch
• Implement network segmentation to limit access to Salt master request server ports
• Review and restrict which systems can communicate with the Salt master

Patch Information

SaltStack has released patched versions addressing this vulnerability. Organizations should upgrade to SaltStack Salt version 3005.2 or 3006.2 or later. The official security advisory is available from the Salt Project Security Advisory. Fedora users can find package updates via the Fedora Package Announcement.

Workarounds

• Restrict network access to Salt master ports using firewall rules to trusted minion IP addresses only
• Implement rate limiting on incoming connections to the Salt master request server
• Deploy a reverse proxy or load balancer with connection filtering in front of the Salt master
• Increase monitoring sensitivity for Salt master availability to enable rapid manual restarts if exploitation occurs

# Example firewall configuration to restrict Salt master access
# Allow only trusted minion networks to access Salt master ports
iptables -A INPUT -p tcp --dport 4505 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 4506 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 4505 -j DROP
iptables -A INPUT -p tcp --dport 4506 -j DROP