SB2021020218 - Denial of service in wolfSSL

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Resource management error (CVE-ID: CVE-2021-3336)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the DoTls13CertificateVerify() function in tls13.c in wolfSSL continues to process requests after certain anomalous peer behavior, such as sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate. A remote attacker can abuse this behavior to consume additional system resources and cause denial of service conditions.

2) Input validation error (CVE-ID: N/A)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing a crafted compressed ECC key with enabled custom ECC curves. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

3) Memory leak (CVE-ID: N/A)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due memory leak with TLS 1.3 authenticated-only ciphers when TLS 1.3 early data is enabled. A section of the server hello could contains 16 bytes of uninitialized data when sent to the connected peer. A remote attacker can gain access to potentially sensitive information.

Remediation

Install update from vendor's website.

References

• https://github.com/wolfSSL/wolfssl/pull/3676
• https://github.com/wolfSSL/wolfssl/releases/tag/v4.7.0-stable