CVE-2024-47535: Netty Denial of Service (DOS) Vulnerability

CVE-2024-47535 Overview

Netty is an asynchronous event-driven network application framework that facilitates rapid development of high-performance protocol servers and clients. A vulnerability was identified where unsafe reading of environment files can lead to a denial of service. Specifically, when operated on a Windows platform, Netty attempts to read a non-existent file, which, if sufficiently large, can cause application crashes.

Critical Impact
An attacker can exploit this vulnerability to cause denial of service by leveraging environment file errors, affecting application availability.

Affected Products

netty netty
microsoft windows

Discovery Timeline

Not Available - Vulnerability discovered by Not Available
Not Available - Responsible disclosure to netty
Not Available - CVE CVE-2024-47535 assigned
Not Available - netty releases security patch
2024-11-12 - CVE CVE-2024-47535 published to NVD
2025-09-05 - Last updated in NVD database

Technical Details for CVE-2024-47535

Vulnerability Analysis

The issue stems from the way Netty loads configuration files in Windows environments. If a large file is placed in a directory where Netty looks for environment files, the application can be rendered inoperative due to resource exhaustion.

Root Cause

The root cause of this vulnerability is improper handling and validation of file sizes while reading environment configurations, potentially leading to resource exhaustion.

Attack Vector

The attack vector for this vulnerability is local, as it requires placing a maliciously large file in a directory read by Netty during startup.

java

// Example exploitation code (sanitized)
public class Exploit {
    public static void main(String[] args) {
        // Simulate a large file creation
        try {
            File file = new File("C:\\path\\to\\large_env_file");
            FileWriter writer = new FileWriter(file);
            for (int i = 0; i < Integer.MAX_VALUE; i++) {
                writer.write("0");
            }
            writer.close();
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

Detection Methods for CVE-2024-47535

Indicators of Compromise

Unusual application crashes
High disk I/O usage
Presence of abnormally large files in configuration directories

Detection Strategies

To detect potential exploitation, monitor application logs for error messages related to file reading. Additionally, implement file size checks and alert when large files appear in configuration directories.

Monitoring Recommendations

Regularly audit file systems for unexpected large files in configuration paths. Utilize SentinelOne endpoint detection to flag unusual file size changes and application behavior deviations.

How to Mitigate CVE-2024-47535

Immediate Actions Required

Remove unauthorized large files from configuration directories
Monitor application behavior for unusual file access patterns
Limit permissions for directories containing environment configurations

Patch Information

The vulnerability has been addressed in Netty version 4.1.115. Users are advised to upgrade to this version to mitigate the risk from this vulnerability. More information is available in the vendor advisory.

Workarounds

As a temporary measure, set file system permissions to restrict access to configuration directories strictly to trusted users and processes.

bash

# Configuration example
chmod 750 /path/to/configuration
chown user:group /path/to/configuration