CVE-2024-38525: 
Amazon Linux vulnerability analysis and mitigation

dd-trace-cpp, the Datadog distributed tracing library for C++, contains a vulnerability in versions prior to 0.2.2 where malformed unicode in trace context can trigger an uncaught exception. The vulnerability was discovered and disclosed in June 2024, affecting versions v0.1.12, v0.2.0, and v0.2.1. When the library fails to extract trace context due to malformed unicode, it attempts to log the list of audited headers and their values using the nlohmann JSON library, which can result in an uncaught exception and subsequent crash (GitHub Advisory).

The vulnerability stems from code introduced in pull request #72, where the library creates a nlohmann::json instance for each key-value pair in the list of audited headers using the format stream << nlohmann::json(it->first + ": " + it->second). This implementation is problematic as exceptions can be thrown by both the JSON library while parsing the input and the implicit call to dump(). The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a high impact on availability (NVD).

This vulnerability affects any downstream applications that rely on dd-trace-cpp for tracing. When triggered, it can cause the application to crash due to the uncaught exception, potentially leading to service disruption (GitHub Advisory).

The vulnerability can be triggered when processing malformed unicode in trace context headers. It requires local access to exploit, with low attack complexity and no privileges or user interaction required, as indicated by the CVSS metrics (NVD).

The vulnerability has been patched in dd-trace-cpp version 0.2.2. As a workaround, users can filter out header values that are not valid UTF-8 strings. It is recommended to upgrade to the patched version to fully address the vulnerability (GitHub Release).