CVE-2021-34813
📋 TL;DR
This vulnerability in Matrix libolm allows a malicious Matrix homeserver to crash a client via a stack-based buffer overflow in the olm_pk_decrypt function during room key backup retrieval. Remote code execution is possible in some nonstandard build configurations. Affects clients using libolm for end-to-end encryption before version 3.2.3.
💻 Affected Systems
- Matrix libolm
- Applications using libolm for encryption (Matrix clients like Element, Nheko, etc.)
📦 What is this software?
Olm by Matrix
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on vulnerable clients, potentially allowing complete compromise of client systems in nonstandard builds.
Likely Case
Client crash/denial of service when interacting with malicious homeservers during key backup operations.
If Mitigated
No impact if patched to version 3.2.3+ or if clients don't use key backup features.
🎯 Exploit Status
Requires malicious homeserver control and client interaction with key backup. Buffer overflow in olm_pk_decrypt function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.3
Vendor Advisory: https://matrix.org/blog/2021/06/14/adventures-in-fuzzing-libolm
Restart Required: Yes
Instructions:
1. Update libolm to version 3.2.3 or later. 2. Rebuild applications using libolm. 3. Restart affected Matrix clients/services.
🔧 Temporary Workarounds
Disable room key backups
allPrevent exploitation by disabling encrypted room key backup retrieval from homeservers
Client-specific configuration - check client settings for 'key backup' or 'encrypted backup' options
🧯 If You Can't Patch
- Restrict client connections to trusted Matrix homeservers only
- Disable all key backup functionality in client configurations
🔍 How to Verify
Check if Vulnerable:
Check libolm version: if <3.2.3 and application uses Olm encrypted key backups, system is vulnerableCheck Version:
pkg-config --modversion olm (Linux) or check library version in application dependenciesVerify Fix Applied:
Confirm libolm version is 3.2.3 or higher and applications have been rebuilt/restarted📡 Detection & Monitoring
Log Indicators:
- Client crashes during key backup operations
- Memory access violation errors in client logs
- Unexpected termination of Matrix clients
Network Indicators:
- Unusual key backup requests from homeservers
- Malformed encrypted data during backup retrieval
SIEM Query:
Application logs containing 'olm_pk_decrypt', 'key backup', or client crash events with memory violation errors🔗 References
- https://gitlab.matrix.org/matrix-org/olm/-/commit/ccc0d122ee1b4d5e5ca4ec1432086be17d5f901b
- https://gitlab.matrix.org/matrix-org/olm/-/releases/3.2.3
- https://matrix.org/blog/2021/06/14/adventures-in-fuzzing-libolm
- https://gitlab.matrix.org/matrix-org/olm/-/commit/ccc0d122ee1b4d5e5ca4ec1432086be17d5f901b
- https://gitlab.matrix.org/matrix-org/olm/-/releases/3.2.3
- https://matrix.org/blog/2021/06/14/adventures-in-fuzzing-libolm
