CVE-2021-21296: 
NixOS vulnerability analysis and mitigation

A vulnerability identified as CVE-2021-21296 was discovered in Fleet server, affecting versions <= 3.6.0. The vulnerability was disclosed on February 3, 2021, and patched in version 3.7.0. The issue affects the Fleet server's live query functionality, which is a telemetry platform for servers and workstations (GitHub Advisory).

The vulnerability exists in the live query results handler of the Fleet server. When a malicious actor with valid node key credentials sends a badly formatted request during an ongoing live query, it can trigger a panic in the server process. The issue specifically relates to the handling of websocket connections and query results processing (GitHub Commit).

If successfully exploited, this vulnerability can cause the Fleet server to exit, resulting in a denial of service (DoS) condition. The impact is considered low due to the requirement of having valid node key credentials to execute the attack. The vulnerability does not lead to information disclosure, privilege escalation, or code execution (GitHub Advisory).

Exploitation of this vulnerability requires the attacker to have a valid node key and can only be executed while a live query is currently ongoing. The attack vector is specifically through the live query functionality of the Fleet server (GitHub Advisory).

The vulnerability has been patched in Fleet version 3.7.0. As a workaround, if this attack is detected, administrators can revoke the node key by deleting the associated host that is being used to carry out the attack. Users are advised to upgrade to version 3.7.0 or later to fully address this vulnerability (GitHub Advisory).