NanoMQ MQTT v5 SUBSCRIBE Handling Protocol-Semantics Vulnerability Leading to Memory-Safety Issue

A protocol-semantics vulnerability has been identified in NanoMQ's MQTT v5 SUBSCRIBE handling, specifically in versions through 0.24.x. The issue arises when a subscription entry omits the final 1-byte Subscription Options field. In such cases, the broker may still accept the malformed packet and incorporate the subscription into its internal state. This flaw can be exploited to create a 1-byte out-of-bounds read that crosses the actual heap allocation boundary, resulting in a heap-buffer-overflow error detected by AddressSanitizer (ASAN). The vulnerability manifests as a semantic acceptance of malformed SUBSCRIBE packets, which should have been rejected according to MQTT rules, and under certain conditions, it leads to a verifiable memory-safety violation.

Impact

The vulnerability disrupts MQTT's validity constraints for SUBSCRIBE entries, allowing incomplete subscription items to be accepted and internal subscription state to be corrupted. This could enable a client to establish a subscription without providing a complete and valid Subscription Options byte. Additionally, under specific input conditions, the vulnerability causes a heap-buffer-overflow, a serious memory-safety issue.

Reproduction

The vulnerability can be reproduced by sending an MQTT v5 SUBSCRIBE packet that lacks the final Subscription Options byte. This can be done using a Python script that establishes a connection to the NanoMQ broker and sends the malformed subscription. The broker's acceptance of the packet can be verified by publishing to the subscribed topic and checking if the message is received, indicating that the subscription was incorrectly accepted. This demonstrates the semantic vulnerability. To reproduce the ASAN-detectable out-of-bounds read, the same subscription can be sent with a carefully constructed packet length that exploits the parser flaw, causing the read to cross into the heap redzone and trigger the heap-buffer-overflow error.