CVE-2020-12403
📋 TL;DR
This vulnerability in NSS (Network Security Services) allows out-of-bounds reads when using multi-part ChaCha20-POLY1305 encryption, potentially exposing sensitive data or causing crashes. It affects systems using NSS versions before 3.55 for cryptographic operations. The primary risks are to confidentiality and system availability.
💻 Affected Systems
- Mozilla NSS (Network Security Services)
- Firefox
- Thunderbird
- Red Hat Enterprise Linux
- CentOS
- Debian
- NetApp products using NSS
📦 What is this software?
Nss by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Memory disclosure leading to exposure of encryption keys or sensitive data, potentially enabling further attacks or causing denial of service through application crashes.
Likely Case
Application instability or crashes when processing specific cryptographic operations, with potential for limited information disclosure.
If Mitigated
Minimal impact if systems are patched or don't use the vulnerable multi-part ChaCha20 functionality.
🎯 Exploit Status
Exploitation requires triggering the vulnerable multi-part ChaCha20 functionality, which may not be commonly used.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: NSS 3.55 or later
Vendor Advisory: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes
Restart Required: Yes
Instructions:
1. Update NSS to version 3.55 or later using your system's package manager. 2. For applications like Firefox/Thunderbird, update to versions using NSS 3.55+. 3. Restart affected services and applications.
🔧 Temporary Workarounds
Disable multi-part ChaCha20
allConfigure applications to avoid using multi-part ChaCha20-POLY1305 encryption mode
Application-specific configuration required; consult documentation
🧯 If You Can't Patch
- Isolate affected systems from untrusted networks
- Monitor for abnormal application crashes or memory access patterns
🔍 How to Verify
Check if Vulnerable:
Check NSS version: 'strings /usr/lib64/libnss3.so | grep Version' or similar for your distributionCheck Version:
rpm -q nss (RHEL/CentOS) or dpkg -l libnss3 (Debian/Ubuntu) or check application about pagesVerify Fix Applied:
Verify NSS version is 3.55 or higher using version check command📡 Detection & Monitoring
Log Indicators:
- Application crashes related to cryptographic operations
- Memory access violation errors in system logs
Network Indicators:
- Unusual patterns in encrypted traffic, though difficult to detect
SIEM Query:
Application logs containing 'segmentation fault', 'access violation', or cryptographic library errors🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=1868931
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes
- https://lists.debian.org/debian-lts-announce/2023/02/msg00021.html
- https://security.netapp.com/advisory/ntap-20230324-0006/
- https://bugzilla.redhat.com/show_bug.cgi?id=1868931
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes
- https://lists.debian.org/debian-lts-announce/2023/02/msg00021.html
- https://security.netapp.com/advisory/ntap-20230324-0006/
