CVE-2023-31274 : Exploit Details and Defense Strategies

A detailed overview of the Missing Release of Resource after Effective Lifetime vulnerability in Aveva PI Server.

Understanding CVE-2023-31274

This article delves into the impact, technical details, and mitigation strategies related to CVE-2023-31274.

What is CVE-2023-31274?

CVE-2023-31274 refers to a vulnerability in Aveva PI Server versions 2023 and 2018 SP3 P05 and earlier. It allows an unauthenticated user to cause the PI Message Subsystem to consume memory, leading to a partial denial-of-service condition.

The Impact of CVE-2023-31274

The vulnerability can result in throttled processing of new PI Data Archive events due to memory consumption by the PI Message Subsystem.

Technical Details of CVE-2023-31274

This section provides detailed insights into the vulnerability, affected systems, and exploitation mechanism.

Vulnerability Description

Aveva PI Server versions 2023 and 2018 SP3 P05 and prior are susceptible to an attack that enables unauthorized memory consumption within the PI Message Subsystem.

Affected Systems and Versions

The vulnerability impacts Aveva PI Server versions 2023 and 2018 SP3 P05 and earlier.

Exploitation Mechanism

An unauthenticated user can exploit the vulnerability to cause the PI Message Subsystem to consume available memory, affecting the processing of new PI Data Archive events.

Mitigation and Prevention

Learn about the immediate steps to take and long-term security recommendations to address CVE-2023-31274.

Immediate Steps to Take

Upgrade to AVEVA PI Server version 2023 Patch 1 or later for all affected versions.
Consider deploying AVEVA PI Server version 2018 SP3 Patch 6 or later as an alternative fix.
Implement defensive measures like auto-restarting the PI Message Subsystem and monitoring memory usage.

Long-Term Security Practices

Limit network access to port 5450 for trusted workstations and software.
Restrict write access to the PI Server Message Log to authorized users only.

Patching and Updates

Organizations are advised to evaluate the impact and apply security updates promptly. More details can be found in the security bulletin AVEVA-2024-001.