CVE-2024-23775
📋 TL;DR
An integer overflow vulnerability in Mbed TLS's mbedtls_x509_set_extension() function allows attackers to cause denial of service (DoS) by triggering memory corruption. This affects systems using Mbed TLS 2.x before 2.28.7 or 3.x before 3.5.2 for X.509 certificate processing.
💻 Affected Systems
- Mbed TLS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through DoS, potentially leading to application crashes or instability in TLS/SSL operations.
Likely Case
Service interruption affecting TLS connections, certificate validation failures, and degraded security functionality.
If Mitigated
Limited impact with proper input validation and memory protection mechanisms in place.
🎯 Exploit Status
Exploitation requires sending specially crafted X.509 certificates to trigger the integer overflow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.28.7 or 3.5.2
Vendor Advisory: https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-2/
Restart Required: Yes
Instructions:
1. Update Mbed TLS to version 2.28.7 or 3.5.2. 2. Recompile applications using Mbed TLS. 3. Restart affected services.
🔧 Temporary Workarounds
Input Validation
allImplement strict validation of X.509 certificate extensions before processing.
🧯 If You Can't Patch
- Implement network segmentation to limit exposure to untrusted certificate sources.
- Use Web Application Firewall (WAF) rules to filter suspicious certificate data.
🔍 How to Verify
Check if Vulnerable:
Check Mbed TLS version: mbedtls_version_get_string() or check library files.Check Version:
For applications: Check build configuration or use mbedtls_version_get_string(). For packages: rpm -q mbedtls or dpkg -l libmbedtls*Verify Fix Applied:
Verify Mbed TLS version is 2.28.7 or higher for 2.x, or 3.5.2 or higher for 3.x.📡 Detection & Monitoring
Log Indicators:
- Application crashes related to mbedtls_x509_set_extension
- TLS handshake failures with malformed certificates
Network Indicators:
- Unusual certificate sizes or extension data in TLS connections
SIEM Query:
Search for process crashes containing 'mbedtls' or 'x509' in error messages.🔗 References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GP5UU7Z6LJNBLBT4SC5WWS2HDNMTFZH5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IIBPEYSVRK4IFLBSYJAWKH33YBNH5HR2/
- https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GP5UU7Z6LJNBLBT4SC5WWS2HDNMTFZH5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IIBPEYSVRK4IFLBSYJAWKH33YBNH5HR2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GP5UU7Z6LJNBLBT4SC5WWS2HDNMTFZH5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIBPEYSVRK4IFLBSYJAWKH33YBNH5HR2/
- https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-2/
