PT-2022-24244 · Wolfssl+2 · Wolfssl+2

Max · Published 2022-08-31 · Updated 2023-03-01 · CVE-2022-38152

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 5.5.0

Description An issue was discovered in wolfSSL when a TLS 1.3 client connects to a wolfSSL server and SSL clear is called on its session, causing the server to crash with a segmentation fault. This occurs in the second session, created through TLS session resumption, which reuses the initial struct WOLFSSL. The server crashes when it reuses the previous session structure by calling wolfSSL clear(WOLFSSL* ssl) on it, and then receives a Client Hello that resumes the previous session. This bug is only triggered when resuming sessions using TLS session resumption and affects servers that use wolfSSL clear instead of the recommended SSL free; SSL new sequence. wolfSSL clear is part of wolfSSL's compatibility layer and is not enabled by default.

Recommendations For versions prior to 5.5.0, consider using the recommended SSL free; SSL new sequence instead of wolfSSL clear to avoid the issue. As a temporary workaround, avoid reusing the previous session structure by calling wolfSSL clear(WOLFSSL* ssl) on it, and instead use the recommended sequence to create a new session. Update to version 5.5.0 or later to resolve the issue.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

ALT-PU-2022-2526

ALT-PU-2023-1034

CVE-2022-38152

Affected Products

Alt Linux

Debian

Wolfssl

References · 16

• 🔥 https://github.com/wolfSSL/wolfssl/pull/5468 · Exploit
• 🔥 http://packetstormsecurity.com/files/170604/wolfSSL-Session-Resumption-Denial-Of-Service.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2023/Jan/7 · Exploit
• https://cve.org/CVERecord?id=CVE-2022-38152 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-38152 · Security Note
• https://ubuntu.com/security/CVE-2022-38152 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-38152 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-38152 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-38152 · Vendor Advisory
• https://wolfssl.com/docs/security-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-38152 · Vendor Advisory
• https://github.com/wolfSSL/wolfssl/releases · Note
• https://github.com/tlspuffin/tlspuffin · Note
• https://t.me/cvenotify/44412 · Telegram Post
• https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh · Note