CVE-2021-28040: 
OSSEC vulnerability analysis and mitigation

An uncontrolled recursion vulnerability was discovered in OSSEC 3.6.0 (CVE-2021-28040). The vulnerability exists in the os_xml.c file where the _ReadElem() function allows unlimited recursion when processing XML tags. The issue was discovered and disclosed in February 2021 (GitHub Issue).

The vulnerability occurs in the XML parsing library (os_xml.c) used by OSSEC. The _ReadElem() function does not implement any recursion limits when processing nested XML tags. When a large number of opening and closing XML tags (<>) are used, the function enters an uncontrolled recursive state. Because recursion is used without restriction, each nested tag causes another stack frame to be allocated until the stack space is exhausted, ultimately leading to a segmentation fault when unmapped memory is accessed (GitHub Issue).

When exploited, this vulnerability can cause a Denial of Service (DoS) condition through a segmentation fault (SIGSEGV) by exhausting the stack memory. This can lead to a crash of the OSSEC service processing the malicious XML input (GitHub Issue).

The vulnerability can be triggered by providing a specially crafted XML file containing a large number of nested XML tags. A proof-of-concept exploit has been publicly documented that demonstrates how to trigger the stack overflow condition (GitHub Issue).

The vulnerability affects OSSEC version 3.6.0. Users should upgrade to a patched version when available. No specific workarounds have been publicly documented (NVD).