Buffer Over-read Vulnerability in wolfSSL Package
Summary
DEBIAN-CVE-2023-6936: In wolfSSL prior to 5.6.6, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS client or network attacker can trigger a buffer over-read on the heap of 5 bytes (WOLFSSL_CALLBACKS is o... Affects wolfssl versions < 5.6.6-1.2. Fixed in 5.6.6-1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wolfSSL is a lightweight SSL/TLS library designed for embedded systems and IoT devices. It provides secure communication protocols and is widely used in various applications due to its efficiency and small footprint. However, prior to version 5.6.6, wolfSSL had a vulnerability that could be exploited when callback functions were enabled, potentially leading to security issues.
Vulnerability Detail
In wolfSSL versions prior to 5.6.6, enabling callback functions (via the WOLFSSL_CALLBACKS flag) could allow a malicious TLS client or network attacker to trigger a buffer over-read on the heap of 5 bytes. This vulnerability arises from the library's handling of callback functions, which are primarily intended for debugging purposes. If exploited, this could lead to unauthorized access to sensitive information or application crashes.
How To Fix
Minimum fixed version
5.6.6-1.2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade wolfsslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the WOLFSSL_CALLBACKS flag if it is not essential for your application. This will prevent the vulnerability from being exploited while you work on updating the package.
Conclusion
The buffer over-read vulnerability in wolfSSL prior to version 5.6.6 poses a significant risk if callback functions are enabled. It is crucial for users to update to the patched version to ensure the security of their applications. Temporary workarounds are available, but the best course of action is to apply the update as soon as possible.
See every vulnerability recorded for wolfssl →
FAQ
The vulnerability allows for a buffer over-read on the heap when callback functions are enabled, potentially exposing sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Callback functions in wolfSSL are used to allow user-defined functions to be called during specific events, primarily for debugging purposes.
Yes, not updating could leave your application vulnerable to attacks that exploit this buffer over-read issue, potentially compromising security.
If immediate updates are not possible, consider disabling the WOLFSSL_CALLBACKS flag as a temporary measure to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for wolfssl.
