Critical Security Update for .NET 9.0: Addressing Type Confusion and DoS Vulnerabilities
Summary
ALSA-2024:9543: Important: .NET 9.0 security update. Affects aspnetcore-runtime-9.0 versions < 9.0.0-1.el9_5. Fixed in 9.0.0-1.el9_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software platform that provides a comprehensive environment for developing and running applications. It includes a variety of APIs and a Common Language Runtime (CLR) that enables the execution of code written in different programming languages. The recent vulnerabilities identified in .NET 9.0 specifically affect the NrbfDecoder component, which is responsible for deserializing .NET objects. These vulnerabilities could lead to severe security issues if not addressed promptly.
Vulnerability Detail
The vulnerabilities in .NET 9.0 arise from a type confusion issue and a denial-of-service (DoS) condition in the NrbfDecoder component. The type confusion vulnerability (CVE-2024-43498) can lead to application crashes (AV) when improperly handled data is processed. The DoS vulnerability (CVE-2024-43499) allows an attacker to exploit the NrbfDecoder component by providing input that causes unbounded work, potentially overwhelming the system and rendering it unresponsive. Both vulnerabilities pose significant risks to application stability and security.
How To Fix
Minimum fixed version
9.0.0-1.el9_5
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if immediate updates cannot be applied, consider implementing input validation to sanitize data before it is processed by the NrbfDecoder component. This may help mitigate the risk of exploitation until the updates can be applied.
Conclusion
The vulnerabilities identified in .NET 9.0 are critical and require immediate attention. By updating to the latest patched versions of the SDK and Runtime, users can protect their applications from potential exploitation. Additionally, utilizing tools like Vulert can help maintain awareness of vulnerabilities in open-source software.
See every vulnerability recorded for aspnetcore-runtime-9.0 →
FAQ
The vulnerabilities involve a type confusion issue and a denial-of-service condition in the NrbfDecoder component, which can lead to application crashes and unresponsiveness.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
If exploited, these vulnerabilities can lead to application crashes, denial of service, and potential unauthorized access to sensitive data.
Yes, implementing input validation to sanitize data before processing can help mitigate risks until updates are applied.
More details about the security updates and their implications can be found on the official CVE pages for CVE-2024-43498 and CVE-2024-43499.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-9.0.
