CVE-2024-11738
📋 TL;DR
A vulnerability in Rustls 0.23.13 and related APIs allows denial of service through a panic when processing fragmented TLS ClientHello messages. This affects any system using vulnerable Rustls versions for TLS connections. The vulnerability can be triggered by sending specially crafted TLS handshake messages.
💻 Affected Systems
- Rustls
- Applications using Rustls library
📦 What is this software?
Rustls by Rustls Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through panic/crash of Rustls applications, potentially affecting availability of TLS-dependent services.
Likely Case
Intermittent service disruptions affecting TLS connections, requiring application restarts to recover.
If Mitigated
Minimal impact if applications have proper restart mechanisms and monitoring in place.
🎯 Exploit Status
Exploitation requires network access to TLS endpoints but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Rustls 0.23.14 or later
Vendor Advisory: https://github.com/advisories/GHSA-qg5g-gv98-5ffh
Restart Required: Yes
Instructions:
1. Update Rustls dependency to version 0.23.14 or later. 2. Rebuild and redeploy affected applications. 3. Restart services using Rustls.
🔧 Temporary Workarounds
Network filtering
allImplement network filtering to block fragmented TLS ClientHello messages.
Load balancer protection
allConfigure load balancers to inspect and filter suspicious TLS handshake patterns.
🧯 If You Can't Patch
- Implement rate limiting on TLS connections to reduce attack surface
- Deploy application monitoring with automatic restart capabilities for crash detection
🔍 How to Verify
Check if Vulnerable:
Check Rustls version in Cargo.toml or via 'cargo tree | grep rustls' for version 0.23.13.Check Version:
cargo tree | grep rustlsVerify Fix Applied:
Verify Rustls version is 0.23.14 or later using 'cargo tree | grep rustls'.📡 Detection & Monitoring
Log Indicators:
- Application panic/crash logs mentioning Rustls
- Unexpected service restarts of TLS-dependent applications
Network Indicators:
- Unusual patterns of fragmented TLS ClientHello messages
- Multiple failed TLS handshake attempts
SIEM Query:
source="application.logs" AND ("panic" OR "crash") AND "rustls"