CVE-2024-12133: Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos
A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.
Other sources
Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos
— Microsoft
The issue is twofold: decoding a DER input with sequences and locating a specific element in a sequence. Even though a DER sequence is conceptually an array, in libtasn1 it is represented as a linked list, whose elements are assigned a string name, such as "?1". Therefore a simple lookup of an element at a given position is linear O(N) time complexity. When decoding a DER sequence, in each step libtasn1 looks up the parent node, recorded on the first element, which requires a backward linear search, resulting in O(N^2) time complexity.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libtasn1-6to a version that resolves this vulnerability.Fixed in 4.16.0-2+deb11u2Fixed in 4.19.0-2+deb12u1Fixed in 4.20.0-2 - Upgrade
Upgrade
libtasn1to a version that resolves this vulnerability.Fixed in 4.20.0Patch CVE-2024-12133
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12133?
CVE-2024-12133 is considered moderate because it can lead to significant performance degradation or crashes when processing certain certificate data.
How do I fix CVE-2024-12133?
To fix CVE-2024-12133, update libtasn1 to version 4.20.1 or later, where the vulnerability is addressed.
What systems are affected by CVE-2024-12133?
CVE-2024-12133 affects GNU libtasn1 version 4.20.0 specifically.
What impact does CVE-2024-12133 have on systems?
CVE-2024-12133 can lead to inefficient handling of certificate data, resulting in slowdowns or crashes.
Can CVE-2024-12133 be exploited remotely?
Yes, CVE-2024-12133 can be exploited by attackers sending specially crafted certificate data.