CVE-2020-36177
📋 TL;DR
This vulnerability in wolfSSL's RSA-PSS padding implementation allows an out-of-bounds write when processing certain cryptographic operations. Attackers can exploit this to execute arbitrary code or cause denial of service. Any system using wolfSSL versions before 4.6.0 for RSA operations with specific key/digest size combinations is affected.
💻 Affected Systems
- wolfSSL embedded SSL/TLS library
📦 What is this software?
Wolfssl by Wolfssl
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of service through application crashes or memory corruption, potentially enabling further exploitation.
If Mitigated
Limited impact if proper input validation and memory protections are in place, but still poses significant risk.
🎯 Exploit Status
Proof-of-concept exists in OSS-Fuzz reports. Exploitation requires specific cryptographic conditions but is feasible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.6.0 and later
Vendor Advisory: https://github.com/wolfSSL/wolfssl/releases/tag/v4.6.0-stable
Restart Required: Yes
Instructions:
1. Download wolfSSL 4.6.0 or later from official repository. 2. Replace existing wolfSSL installation. 3. Recompile applications using wolfSSL. 4. Restart affected services.
🔧 Temporary Workarounds
Disable RSA-PSS operations
allConfigure wolfSSL to disable RSA-PSS padding if not required
Configure with --disable-rsapss or set NO_RSA_BOUNDS_CHECK
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems
- Deploy application firewalls to monitor and block suspicious cryptographic operations
🔍 How to Verify
Check if Vulnerable:
Check wolfSSL version: wolfSSL_lib_version() or examine library files. Versions < 4.6.0 are vulnerable.Check Version:
wolfSSL_lib_version() or strings libwolfssl.so | grep -i versionVerify Fix Applied:
Verify version is 4.6.0 or later and check for commit 63bf5dc56ccbfc12a73b06327361687091a4c6f7 in source.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory corruption errors
- Unexpected termination of SSL/TLS services
Network Indicators:
- Malformed cryptographic handshakes targeting RSA-PSS
SIEM Query:
source="*wolfssl*" AND (event="segmentation fault" OR event="memory corruption")🔗 References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26567
- https://github.com/wolfSSL/wolfssl/commit/63bf5dc56ccbfc12a73b06327361687091a4c6f7
- https://github.com/wolfSSL/wolfssl/commit/fb2288c46dd4c864b78f00a47a364b96a09a5c0f
- https://github.com/wolfSSL/wolfssl/pull/3426
- https://github.com/wolfSSL/wolfssl/releases/tag/v4.6.0-stable
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26567
- https://github.com/wolfSSL/wolfssl/commit/63bf5dc56ccbfc12a73b06327361687091a4c6f7
- https://github.com/wolfSSL/wolfssl/commit/fb2288c46dd4c864b78f00a47a364b96a09a5c0f
- https://github.com/wolfSSL/wolfssl/pull/3426
- https://github.com/wolfSSL/wolfssl/releases/tag/v4.6.0-stable
