CVE-2021-43399
📋 TL;DR
This vulnerability in Yubico's YubiHSM2 library allows buffer overflow attacks by not properly validating input lengths for SSH signing and data operations. Attackers could potentially execute arbitrary code or cause denial of service on systems using YubiHSM 2 hardware security modules. Organizations using YubiHSM 2 devices with the vulnerable library are affected.
💻 Affected Systems
- Yubico YubiHSM2 library
- yubihsm-shell
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete compromise of the HSM functionality, potentially allowing extraction of cryptographic keys or manipulation of secure operations.
Likely Case
Denial of service causing the YubiHSM device to crash or become unresponsive, disrupting cryptographic operations and services relying on it.
If Mitigated
Limited impact with proper network segmentation and access controls, potentially only affecting availability of HSM services.
🎯 Exploit Status
Exploitation requires network access to the yubihsm-shell service and ability to send malformed requests. Technical details and proof-of-concept are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021.11 or later
Vendor Advisory: https://www.yubico.com/support/security-advisories/ysa-2021-04/
Restart Required: Yes
Instructions:
1. Update yubihsm-shell to version 2021.11 or later. 2. Restart any services using the YubiHSM2 library. 3. Verify the update was successful by checking the version.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict network access to yubihsm-shell services to only trusted administrative networks
iptables -A INPUT -p tcp --dport 12345 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 12345 -j DROP
Access Control
allImplement strict authentication and authorization controls for yubihsm-shell access
🧯 If You Can't Patch
- Implement strict network segmentation to isolate YubiHSM management interfaces
- Monitor for unusual yubihsm-shell activity and implement rate limiting on connections
🔍 How to Verify
Check if Vulnerable:
Check yubihsm-shell version: yubihsm-shell --versionCheck Version:
yubihsm-shell --versionVerify Fix Applied:
Verify version is 2021.11 or later and test SSH signing operations with malformed input📡 Detection & Monitoring
Log Indicators:
- Multiple failed SSH signing attempts
- yubihsm-shell process crashes
- Unusual length parameters in HSM operations
Network Indicators:
- Unusual traffic patterns to yubihsm-shell port
- Multiple connection attempts with varying payload sizes
SIEM Query:
source="yubihsm-shell" AND (error OR crash OR "invalid length")