CVE-2023-34462: netty-handler SniHandler 16MB allocation
Summary The SniHandler can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the SniHandler to allocate 16MB of heap.
Details The SniHandler class is a handler that waits for the TLS handshake to configure a SslHandler according to the indicated server name by the ClientHello record. For this matter it allocates a ByteBuf using the value defined in the ClientHello record.
Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the SslClientHelloHandler
1/ allocate a 16MB ByteBuf 2/ not fail decode method in buffer 3/ get out of the loop without an exception
The combination of this without the use of a timeout makes easy to connect to a TCP server and allocate 16MB of heap memory per connection.
Impact If the user has no idle timeout handler configured it might be possible for a remote peer to send a client hello packet which lead the server to buffer up to 16MB of data per connection. This could lead to a OutOfMemoryError and so result in a DDOS.
Other sources
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The SniHandler can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the SniHandler to allocate 16MB of heap. The SniHandler class is a handler that waits for the TLS handshake to configure a SslHandler according to the indicated server name by the ClientHello record. For this matter it allocates a ByteBuf using the value defined in the ClientHello record. Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the SslClientHelloHandler. This vulnerability has been fixed in version 4.1.94.Final.
— MITRE
Netty is vulnerable to a denial of service, caused by a flaw with allocating up to 16MB of heap for each channel during the TLS handshake the SniHandler class. By sending a specially crafted client hello packet, a remote authenticated attacker could exploit this vulnerability to cause a OutOfMemoryError and so result in a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-34462?
CVE-2023-34462 refers to a vulnerability in the Netty framework that allows the SniHandler to allocate up to 16MB of heap for each channel during the TLS handshake.
How does CVE-2023-34462 impact Netty?
CVE-2023-34462 can result in excessive memory usage by the SniHandler during the TLS handshake, potentially leading to resource exhaustion and denial of service.
What is the severity of CVE-2023-34462?
CVE-2023-34462 has a severity score of 6.5, which is considered medium.
Which versions of Netty are affected by CVE-2023-34462?
Netty versions up to and including 4.1.94 are affected by CVE-2023-34462.
How can CVE-2023-34462 be fixed?
To fix CVE-2023-34462, upgrade to version 4.1.95 or later of the Netty framework.