CVE-2024-12243: Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos
A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition.
Other sources
Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos
— Microsoft
The issue is twofold: decoding a DER input with sequences and locating a specific element in a sequence. Even though a DER sequence is conceptually an array, in libtasn1 it is represented as a linked list, whose elements are assigned a string name, such as "?1". Therefore a simple lookup of an element at a given position is linear O(N) time complexity. When decoding a DER sequence, in each step libtasn1 looks up the parent node, recorded on the first element, which requires a backward linear search, resulting in O(N^2) time complexity.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gnutls28to a version that resolves this vulnerability.Fixed in 3.7.1-5+deb11u10Fixed in 3.7.9-2+deb12u6Fixed in 3.7.9-2+deb12u7Fixed in 3.8.9-3+deb13u3Fixed in 3.8.9-3+deb13u4Fixed in 3.8.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12243?
CVE-2024-12243 is classified as a medium severity vulnerability due to its potential to cause resource exhaustion.
How do I fix CVE-2024-12243?
To fix CVE-2024-12243, update to the latest versions of GnuTLS and libtasn1 that contain the security patch.
Who is affected by CVE-2024-12243?
CVE-2024-12243 affects users and applications that utilize GnuTLS and libtasn1 for ASN.1 data processing.
What are the implications of CVE-2024-12243?
The implications of CVE-2024-12243 include potential denial of service due to high resource consumption from processing malicious DER-encoded certificates.
How can attackers exploit CVE-2024-12243?
Attackers can exploit CVE-2024-12243 by sending specially crafted DER-encoded certificate data to the affected system.