PT-2022-24245 · Wolfssl+1 · Wolfssl+1

Max · Published 2022-07-13 · Updated 2023-03-01 · CVE-2022-38153

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions wolfSSL version 5.3.0

Description An issue in wolfSSL allows man-in-the-middle attackers or a malicious server to crash TLS 1.2 clients during a handshake. This occurs when an attacker injects a large ticket (more than 256 bytes) into a NewSessionTicket message in a TLS 1.2 handshake, and the client has a non-empty session cache, causing the session cache to free a pointer that points to unallocated memory. It is likely that this issue is also exploitable during TLS 1.3 handshakes between a client and a malicious server, although it cannot be exploited as a man-in-the-middle in TLS 1.3.

Recommendations For wolfSSL version 5.3.0, update to version 5.5.0 or later to resolve the issue. As a temporary workaround, consider disabling the --enable-session-ticket option until a patch is available. Restrict access to the NewSessionTicket message in TLS 1.2 handshakes to minimize the risk of exploitation. Avoid using large tickets (more than 256 bytes) in the NewSessionTicket message until the issue is resolved.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALT-PU-2022-2238

CVE-2022-38153

Affected Products

Alt Linux

Wolfssl

References · 17

• 🔥 https://github.com/wolfSSL/wolfssl/pull/5476 · Exploit
• 🔥 http://packetstormsecurity.com/files/170605/wolfSSL-5.3.0-Denial-Of-Service.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2023/Jan/8 · Exploit
• https://ubuntu.com/security/CVE-2022-38153 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-38153 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-38153 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-38153 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38153 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-38153 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38153 · Security Note
• https://wolfssl.com/docs/security-vulnerabilities · Vendor Advisory
• https://github.com/wolfSSL/wolfssl/releases · Note
• https://github.com/trailofbits/tlspuffin · Note
• https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh · Note
• https://t.me/cvenotify/44413 · Telegram Post