Listen to this Post
In AMQConnection.java lines 435-436, after Connection.Tune negotiation, frame-max is set using Math.min(this.maxInboundMessageBodySize, frameMax).
When frameMax=0, which AMQP spec defines as unlimited, Math.min(67108864, 0) returns 0.
The resulting 0 is passed to Utils.framePayloadLimit(0).
In Utils.java lines 77-79, framePayloadLimit returns Integer.MAX_VALUE when frameMax <= 0.
This disables the maxInboundMessageBodySize protection, default 64MB, at the frame level.
A malicious AMQP server or MITM can send Connection.Tune with frameMax=0.
The client default requestedFrameMax is 0 from ConnectionFactory.DEFAULT_FRAME_MAX line 82.
negotiatedMaxValue(0, 0) becomes Math.max(0, 0), which is 0 at lines 673-676.
Math.min(maxInboundMessageBodySize, 0) becomes 0, so the 64MB cap is defeated.
framePayloadLimit(0) then returns Integer.MAX_VALUE, so no frame size enforcement remains.
The attacker sends a single frame with frameSize = 0x1FFFFFFF, about 500MB.
Frame.readFrom() at line 135 executes new byte
.</h2>
<h2 style="color: blue;">This allocation can trigger an OutOfMemoryError crash.</h2>
The frame does not need to be a body frame.
Method frames, header frames, or heartbeat frames with a crafted size field all trigger allocation.
<h2 style="color: blue;">The allocation happens before any content-level check fires.</h2>
The root cause is that AMQP uses frameMax=0 to mean unlimited.
<h2 style="color: blue;">Math.min treats 0 as the integer value zero.</h2>
The intent of lines 435-436 was to take the smaller of two limits.
When one limit uses 0-means-unlimited semantics, Math.min always selects zero.
<h2 style="color: blue;">This disables the other limit, maxInboundMessageBodySize.</h2>
The impact includes default configuration vulnerability because requestedFrameMax and legitimate server frameMax may be 0.
A single malicious frame can trigger up to about 2GB allocation, Integer.MAX_VALUE bytes.
This bypasses existing protection maxInboundMessageBodySize introduced to cap allocations at 64MB.
This differs from ValueReader OOM because it is a frame-layer allocation in Frame.readFrom().
<h2 style="color: blue;">It is not a value-layer allocation in ValueReader.readBytes().</h2>
<h2 style="color: blue;">Affected code includes AMQConnection.java:435-436 with Math.min and 0-means-unlimited.</h2>
<h2 style="color: blue;">Affected code includes Utils.java:77-79 where framePayloadLimit(0) returns Integer.MAX_VALUE.</h2>
<h2 style="color: blue;">Affected code includes Frame.java:135 where new byte[bash] allocates.</h2>
<h2 style="color: blue;">Affected code includes ConnectionFactory.java:82 where DEFAULT_FRAME_MAX = 0.</h2>
The suggested fix treats frameMax=0 as use maxInboundMessageBodySize as the cap instead of zero.
This restores the intended limit before Frame.readFrom() allocates memory.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: RabbitMQ Java Client
Version: before 5.18.0
Vulnerability : frameMax zero OOM
Severity: High
date: 2023-10-24
<h2 style="color: blue;">Prediction: 2023-10-11</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
[bash]
grep -R "setFrameMax" -n .
grep -R "framePayloadLimit" -n .
grep -R "DEFAULT_FRAME_MAX" -n .
_frameHandler.setFrameMax(
Math.min(this.maxInboundMessageBodySize, frameMax));
static int framePayloadLimit(int frameMax) {
if (frameMax <= 0) {
return Integer.MAX_VALUE;
}
// ...
}
Frame.readFrom() -> new byte[bash];
Exploit: (Educational Purposes!)
// Malicious AMQP server
// Send Connection.Tune with frameMax = 0
// Then send frame with frameSize = 0x1FFFFFFF
Protection: from this CVE Impact:
-
</dt>
<dt>int effectiveFrameMax = (frameMax == 0)</dt>
<dt>? this.maxInboundMessageBodySize</dt>
<dd>Math.min(this.maxInboundMessageBodySize, frameMax);
_frameHandler.setFrameMax(effectiveFrameMax);
Upgrade to RabbitMQ Java Client 5.18.0+
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
</dt> <dt>int effectiveFrameMax = (frameMax == 0)</dt> <dt>? this.maxInboundMessageBodySize</dt> <dd>Math.min(this.maxInboundMessageBodySize, frameMax); _frameHandler.setFrameMax(effectiveFrameMax);
Upgrade to RabbitMQ Java Client 5.18.0+
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
