CVE-2024-1023: 
Java vulnerability analysis and mitigation

A vulnerability in the Eclipse Vert.x toolkit (CVE-2024-1023) results in a memory leak due to using Netty FastThreadLocal data structures. The vulnerability was discovered in Vert.x versions 4.4.5, 4.4.6, 4.5.0, and 4.5.1. Specifically, when the Vert.x HTTP client establishes connections to different hosts, it triggers the memory leak. The issue was first reported in January 2024 and has been assigned a CVSS v3 base score of 6.5 (Moderate severity) (Red Hat CVE).

The vulnerability stems from the CombinerExecutor class creating an instance of FastThreadLocal for each combiner executor, leading to an increase of the InternalThreadLocalMap index. Consequently, each thread local map of FastThreadLocalThread gets a new map sized accordingly, causing the memory leak. The issue occurs specifically when the Vert.x HTTP client connects to different hosts, making the leak progress further. For example, after approximately 8 hours of uptime, each of the 128 threads can have indexedVariables arrays with lengths exceeding 8,000,000 and consuming over 60MB of memory, with 99.999% of values being empty (GitHub Issue).

The memory leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak. This can lead to significant memory consumption and potential system instability (Red Hat CVE).

The vulnerability can be exploited in environments where an attacker can control the addresses to which the Vert.x HTTP client connects. The leak can be accelerated through targeted manipulation of connection patterns, particularly in scenarios where a server accepts and processes arbitrary internet addresses (GitHub Issue).

The issue has been fixed by modifying the CombinerExecutor class to use a static FastThreadLocal instead of an instance field. The fix was implemented in Vert.x versions 4.4.7 and 4.5.2. Users are advised to upgrade to these or later versions to address the vulnerability. The data structure stored in the thread local map has been optimized to keep track of the CombinerExecutor running without interfering with other tasks (GitHub PR).