CVE-2023-31127
📋 TL;DR
This vulnerability allows an attacker to bypass mutual authentication in libspdm sessions when both DHE and PSK session types are supported. An attacker can establish a session using KEY_EXCHANGE but finish with PSK_FINISH, exploiting a missing hash validation check. Only SPDM responders supporting both KEY_EX_CAP=1 and PSK_CAP=10b with mutual authentication are affected.
💻 Affected Systems
- libspdm
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized access to secure SPDM sessions, potentially compromising device-to-device authentication and enabling man-in-the-middle attacks on firmware updates or secure communications.
Likely Case
Authentication bypass allowing unauthorized devices to establish sessions with vulnerable responders, potentially leading to data exposure or unauthorized firmware updates.
If Mitigated
No impact if proper controls disable vulnerable configurations or patches are applied.
🎯 Exploit Status
Exploitation requires specific configuration conditions and understanding of SPDM protocol, but no authentication is needed once those conditions are met.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.1 or later (2.3.2 for 2.3 branch)
Vendor Advisory: https://github.com/DMTF/libspdm/security/advisories/GHSA-qw76-4v8p-xq9f
Restart Required: Yes
Instructions:
1. Update libspdm to version 2.3.1 or later. 2. For 2.3 branch users, update to 2.3.2 when available. 3. Recompile and redeploy any applications using libspdm. 4. Restart affected services or devices.
🔧 Temporary Workarounds
Disable vulnerable configurations
allDisable either DHE sessions (KEY_EX_CAP=0) or PSK sessions with mutual authentication (PSK_CAP=0 or PSK_CAP=01b) to prevent exploitation.
# Configure libspdm to disable vulnerable combination
# Set KEY_EX_CAP=0 OR PSK_CAP=0 in SPDM responder configuration
🧯 If You Can't Patch
- Disable mutual authentication requirement for PSK sessions (set PSK_CAP=01b)
- Implement network segmentation to isolate SPDM responders from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check libspdm version and configuration: 1. Verify libspdm version is 1.0-2.3. 2. Check if KEY_EX_CAP=1 and PSK_CAP=10b are both enabled. 3. Confirm mutual authentication is required.Check Version:
# For libspdm: check version in source code or build configurationVerify Fix Applied:
1. Confirm libspdm version is 2.3.1 or later. 2. Verify the fix by checking that session hash validation now properly detects mismatched KEY_EXCHANGE/PSK_FINISH combinations.📡 Detection & Monitoring
Log Indicators:
- Failed SPDM session establishment attempts
- Mismatched KEY_EXCHANGE and PSK_FINISH messages in SPDM logs
- Unexpected successful session establishments
Network Indicators:
- SPDM traffic showing KEY_EXCHANGE followed by PSK_FINISH from same session
- Unusual SPDM session patterns
SIEM Query:
SPDM AND (KEY_EXCHANGE OR PSK_FINISH) AND session_establishment🔗 References
- https://github.com/DMTF/libspdm/pull/2006
- https://github.com/DMTF/libspdm/pull/2007
- https://github.com/DMTF/libspdm/security/advisories/GHSA-qw76-4v8p-xq9f
- https://github.com/DMTF/libspdm/pull/2006
- https://github.com/DMTF/libspdm/pull/2007
- https://github.com/DMTF/libspdm/security/advisories/GHSA-qw76-4v8p-xq9f
