Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot in src/plugins.d/pluginsd_internals.h. The accepted slot drives reallocz to request an approximately 16 GiB chart-pointer array, and allocation failure invokes fatal and aborts the parent Netdata agent, repeatedly disabling centralized monitoring while stream access persists.
This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819…
security-advisories@github.com
https://github.com/netdata/netdata/pull/22598
security-advisories@github.com
https://github.com/netdata/netdata/releases/tag/v2.10.4
security-advisories@github.com
https://github.com/netdata/netdata/security/advisories/GHSA-3mxw-fv2x-rhc6
security-advisories@github.com