CVE-2026-92698

Description

A flaw was found in FastNetMon. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted sFlow packet with an inflated header size. Because the application fails to properly validate the header length against the received packet buffer, processing the packet results in an out-of-bounds memory read. This can lead to a Denial of Service (DoS) by causing the process to crash, as well as potential limited information disclosure of adjacent memory contents.

Statement

Red Hat Product Security rates this vulnerability as Important severity because an unauthenticated remote attacker can trigger a denial of service or disclose adjacent process memory without requiring prior privileges or user interaction. Successful exploitation causes FastNetMon to terminate abnormally, disrupting real-time network anomaly detection and DDoS monitoring across the infrastructure. This flaw specifically affects deployments where the sFlow collector plugin is enabled and reachable from untrusted network segments.

Mitigation

To mitigate this issue, restrict network exposure of the sFlow collector port (default UDP port 6343) or disable the sFlow plugin if it is not required:

1. Restrict incoming sFlow traffic to trusted network flow exporter IP addresses using firewalld:

firewall-cmd --permanent --zone=public --remove-port=6343/udp
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_EXPORTER_IP>" port port="6343" protocol="udp" accept'
firewall-cmd --reload

2. Alternatively, if sFlow collection is not utilized by your deployment (e.g., using NetFlow or raw packet capture), disable sFlow processing in `/etc/fastnetmon.conf`:

sflow = off
After editing the configuration, restart the daemon:
systemctl restart fastnetmon

Warning: Restarting FastNetMon or reloading the firewall will briefly interrupt flow metrics collection and traffic monitoring. Disabling sFlow will halt all ingestion of sFlow telemetry.

--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to validate raw packet header size against remaining buffer bytes in the FastNetMon sFlow collector parser before nested parsing: upgrade to the fixed Fastnetmon builds, which validate that the record length is non-negative and sufficiently large, and reject records where header_size exceeds remaining available payload length, closing all 2 injection vectors (crafted sFlow v5 UDP packet with an inflated header size, sFlow raw packet header record with undersized or negative length). Until patched, this is a concern on Linux hosts running FastNetMon with the sFlow collector plugin enabled and reachable via UDP port 6343, so restrict incoming UDP port 6343 traffic to trusted flow exporter IP addresses via firewall rules or disable sFlow processing in fastnetmon.conf. As a compensating measure, run SELinux in enforcing mode to confine the FastNetMon process domain, deploy EDR monitoring to detect abnormal process crashes or segmentation faults in FastNetMon, and configure Falco or eBPF runtime tooling to alert on process termination signals such as SIGSEGV. These controls limit blast radius and contain exploitation, but they do not fix the underlying out-of-bounds read defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1001 EDR Agent (Endpoint Detection & Response) (medium)

Understanding the Weakness (CWE)

CWE-125

Confidentiality

Technical Impact: Read Memory

An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.

Confidentiality

Technical Impact: Bypass Protection Mechanism

Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.

Availability

Technical Impact: DoS: Crash, Exit, or Restart

An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.

Other

Technical Impact: Varies by Context

The read operation could produce other undefined or unexpected results.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.