CVE-2023-23759
📋 TL;DR
This vulnerability in the fizz TLS library allows remote attackers to cause denial of service by triggering a CHECK failure when client cipher advertisements change between ClientHello messages. Systems using fizz versions prior to v2023.01.30.00 are affected, potentially causing service crashes.
💻 Affected Systems
- fizz TLS library
📦 What is this software?
Fizz by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage due to process crashes, leading to extended downtime until services are restarted.
Likely Case
Intermittent service disruptions affecting availability, requiring process restarts to recover.
If Mitigated
Minimal impact with proper monitoring and automated recovery mechanisms in place.
🎯 Exploit Status
Exploitation requires network access to trigger the specific ClientHello sequence.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2023.01.30.00
Vendor Advisory: https://www.facebook.com/security/advisories/cve-2023-23759
Restart Required: Yes
Instructions:
1. Update fizz library to v2023.01.30.00 or later. 2. Rebuild and redeploy applications using fizz. 3. Restart affected services.
🔧 Temporary Workarounds
Network filtering
allImplement network controls to filter or rate-limit ClientHello messages with changing cipher advertisements.
🧯 If You Can't Patch
- Implement network segmentation to limit exposure to untrusted clients
- Deploy monitoring and automated restart mechanisms for affected services
🔍 How to Verify
Check if Vulnerable:
Check fizz library version in your application dependencies or deployment.Check Version:
Check application dependency manifest or library version filesVerify Fix Applied:
Confirm fizz version is v2023.01.30.00 or later after update.📡 Detection & Monitoring
Log Indicators:
- Process crashes or abnormal terminations in fizz-related services
- Error logs containing CHECK failures
Network Indicators:
- Multiple ClientHello messages with changing cipher suites from single sources
SIEM Query:
Process termination events for services using fizz library