In plain words
Imagine you have a shared mailbox where multiple people can pick up their mail, but sometimes the mailroom staff might accidentally give someone else's mail to you, or even let you send mail from someone else's account. This bug is similar, where a part of the Apache server that handles multiple connections at once can get confused and let an attacker interfere with other users' connections or even take control of the server.
What's broken
The bug is in the mod_http2 part of the Apache HTTP Server¹, specifically in how it handles shared sessions and temporary data. An attacker could use this bug to crash the server or potentially take control of it, by exploiting a use-after-free² vulnerability, which means using memory that has already been freed, and a wild write³, which means writing data to random places in memory. The affected versions are Apache HTTP Server 2.4.0 through 2.4.68.
How it actually works
Here's how it works: when multiple users are connected to the server at the same time, the server uses a shared session to keep track of all the connections. However, due to a flaw in the mod_http2 module, an attacker can cause the server to use memory that has already been freed, or write data to random places in memory, which can lead to a crash or allow the attacker to take control of the server. This is possible because of a re-entrancy⁴ issue, where the server's handling of shared sessions can be interrupted and reused by an attacker.
Proof of concept
There is a public proof-of-concept⁵, which demonstrates that the bug is real and can be exploited. A proof-of-concept is like a demo that shows the bug can be used to crash the server or take control of it. This makes the bug more urgent, because it shows that attackers can use it to cause real harm.
Is it real
It's not clear from the source if this bug is being actively exploited in the wild. However, the bug can be mitigated by updating the Apache HTTP Server to a version that fixes the issue.
What to do
To fix this bug, you should update your Apache HTTP Server to a version that is not affected, such as any version after 2.4.68. This will patch the vulnerability and prevent attackers from exploiting it.
Terms
- ¹ Apache HTTP Server
- , a popular web server software
- ² use-after-free
- , a type of vulnerability that occurs when memory is used after it has been freed
- ³ wild write
- , a type of vulnerability that occurs when data is written to random places in memory
- ⁴ re-entrancy
- , a situation where a process is interrupted and reused, potentially allowing an attacker to exploit it
- ⁵ proof-of-concept
- , a demo that shows a bug can be exploited to cause harm