PT-2023-32554 · Unknown · Tokio-Boring

Ehaydenr + 1 · Published 2023-12-05 · Updated 2023-12-12 · CVE-2023-6180

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions tokio-boring version 4.0.0

Description The issue is related to a memory leak that can cause excessive resource consumption and potentially lead to a Denial of Service (DoS) by resource exhaustion. This occurs because the set ex data function, used by the library, fails to deallocate memory used by pre-existing data after completing a TLS connection, resulting in increased resource consumption with each new connection.

Recommendations For tokio-boring version 4.0.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Resource Release

Memory Leak

Resource Exhaustion

Weakness Enumeration

CWE-404

CWE-401

CWE-400

Related Identifiers

CVE-2023-6180

GHSA-PJRJ-H4FG-6GM4

Affected Products

Tokio-Boring

References · 7

• https://github.com/cloudflare/boring/security/advisories/GHSA-pjrj-h4fg-6gm4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6180 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6180 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pjrj-h4fg-6gm4 · Vendor Advisory
• https://github.com/cloudflare/boring · Note
• https://github.com/cloudflare/boring/commit/a32783374f2682e6949fdb713910b1b9f103d3ed · Note
• https://twitter.com/CVEnew/status/1732061884621463856 · Twitter Post