CVE-2021-20235: 
ZeroMQ vulnerability analysis and mitigation

A buffer overflow vulnerability (CVE-2021-20235) was discovered in ZeroMQ versions before 4.3.3, specifically in the src/decoder_allocators.hpp component. The vulnerability affects the decoder static allocator, where its size could be changed while the buffer remained static. This vulnerability was identified and disclosed in April 2021 (NVD, GitHub Advisory).

The vulnerability exists in the decoder static allocator implementation where it attempts to shrink its recorded size similar to the shared allocator. However, unlike the shared allocator, the static allocator uses a static buffer with a size defined by the ZMQ_IN_BATCH_SIZE socket option (default 8192). The vulnerability can be triggered when processing ZMTP v1 packets, particularly when handling messages larger than the buffer size. The issue has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD, GitHub Advisory).

The vulnerability can lead to a buffer overflow WRITE of arbitrary data, potentially affecting application availability, data integrity, and confidentiality. The impact is particularly severe when CURVE/ZAP authentication is not enabled, as it allows remote, unauthenticated attackers to exploit the vulnerability (NVD, Ubuntu Notice).

The vulnerability can be exploited by sending crafted requests to the ZeroMQ server. A proof-of-concept exists where setting ZMQ_IN_BATCH_SIZE to 4 and sending specific hex-encoded data over a plain TCP socket to a libzmq peer can trigger the vulnerability. The exploit is only possible when CURVE/ZAP authentication is not enabled (GitHub Advisory).

The primary mitigation is to upgrade to ZeroMQ version 4.3.3 or later, which contains the fix for this vulnerability. As a workaround, enabling CURVE/ZAP authentication for public endpoints can prevent exploitation, as ZMTP v1 peers are immediately rejected before any content processing occurs (GitHub Advisory, Red Hat Bugzilla).