CVE-2021-26528: 
NixOS vulnerability analysis and mitigation

The Cesanta Mongoose HTTP server version 7.0 contains a vulnerability (CVE-2021-26528) that allows remote out-of-bounds write attacks through connection requests. The vulnerability was discovered and disclosed in February 2021. The issue affects the mg_http_serve_file function when handling HTTP requests after exhausting the memory pool (GitHub Issue).

The vulnerability exists in the mg_http_serve_file function (mongoose.c:800) due to incorrect error handling of calloc return values. When memory allocation fails, the code attempts to dereference a NULL pointer, which can lead to a segmentation fault or potential memory corruption. The issue is triggered during HTTP request handling, where memory allocations occur for each request (GitHub Issue). The vulnerability has been assigned a CVSS v3.1 Base Score of 9.1 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (NVD).

The vulnerability can result in NULL pointer dereference and segmentation fault errors in systems with restrictive memory protection, or near-NULL pointer overwrites in environments with limited memory restrictions, such as embedded systems. In embedded environments where near-zero memory areas store device configuration, this vulnerability could potentially allow remote attackers to overwrite configuration data (GitHub Issue).

The vulnerability can be exploited remotely by flooding the server with HTTP requests until memory exhaustion occurs. No authentication is required to exploit this vulnerability, making it particularly dangerous. The issue has been confirmed to be exploitable through proof-of-concept code (GitHub Issue).

Users should update to a version of Mongoose HTTP server that contains the fix for this vulnerability. The issue was reported in version 7.0, and subsequent releases should include the necessary patches (NVD).