CVE-2023-24609: Integer Overflow
Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. An attacked device calculates an SHA-2 hash over at least 65 KB (in RAM). With a large number of crafted TLS messages, the CPU becomes heavily loaded. This occurs in tls13VerifyBinder and tls13TranscriptHashUpdate.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-24609?
CVE-2023-24609 is classified as a high severity vulnerability due to its potential to cause CPU exhaustion and denial of service.
How do I fix CVE-2023-24609?
To mitigate CVE-2023-24609, upgrade Matrix SSL to version 4.6.1 or above, and apply patches provided by Rambus for the TLS Toolkit.
What systems are affected by CVE-2023-24609?
CVE-2023-24609 affects Matrix SSL versions 4.0.0 through 4.6.0 and the Rambus TLS Toolkit.
What type of attacks can exploit CVE-2023-24609?
CVE-2023-24609 can be exploited through crafted TLS messages leading to an integer overflow and potential denial of service.
Is CVE-2023-24609 remote exploitable?
Yes, CVE-2023-24609 can be exploited remotely over a network by sending specially crafted TLS messages.