Denial of Service Vulnerability in wolfSSL Software
CVE-2022-38152

7.5HIGH

Key Information:

Vendor

Wolfssl

Status
Wolfssl
Vendor
CVE Published:
31 August 2022

What is CVE-2022-38152?

A vulnerability exists in wolfSSL versions prior to 5.5.0 that can lead to a denial of service when a TLS 1.3 client connects to a wolfSSL server. If a server uses the 'wolfSSL_clear' function to handle session resumption, a segmentation fault can occur resulting in a crash upon receiving the next Client Hello after the initial session reuse. This issue arises specifically when reusing the session structure 'struct WOLFSSL', which could cause disruption under certain conditions. It is important to note that the affected feature, 'wolfSSL_clear', is part of wolfSSL's compatibility layer and is not enabled by default, protecting servers that utilize the native API.

References

https://github.com/wolfSSL/wolfssl/releases
https://www.wolfssl.com/docs/security-vulnerabilities/
https://github.com/wolfSSL/wolfssl/pull/5468

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.