ZeroDay Findings
Sign inSign up

Every 24 hours

Tech

Original briefings on what changed in security. Each story has a small illustration matched to what it covers, a short structure, and links to the catalog records and public identifiers it discusses.

  1. Nov 6, 2023

    Performance Issues in X9.42 DH Key Generation and Validation

    Recent findings reveal that generating and validating excessively long X9.42 DH keys can lead to significant performance delays, potentially resulting in Denial of Service scenarios.

    What changed

    The performance of applications utilizing X9.42 Diffie-Hellman (DH) key generation and validation functions has come under scrutiny. Specifically, operations involving excessively long keys or parameters can result in considerable slowdowns.

    Functions such as DH_generate_key(), DH_check_pub_key(), DH_check_pub_key_ex(), and EVP_PKEY_public_check() are particularly affected, leading to potential Denial of Service (DoS) conditions.

    Who is affected

    Various applications and systems that rely on X9.42 DH key generation and validation are at risk. This includes:

    Developers and organizations that implement cryptographic protocols using X9.42 DH standards may experience significant delays.

    • Cryptographic libraries that include X9.42 DH functions.
    • Enterprise applications that utilize these cryptographic methods for secure communications.
    • Any system that relies on external sources for key parameters, increasing the risk of performance degradation.

    What to do

    To mitigate the risks associated with these performance issues, organizations should consider reviewing their implementation of X9.42 DH functions. This includes:

    Implementing checks to limit the length of keys and parameters being processed.

    • Regularly audit cryptographic implementations to ensure compliance with best practices.
    • Consider alternative key generation methods if performance issues persist.
    • Stay informed about updates and patches related to cryptographic libraries.

  2. Nov 1, 2023

    Critical Use-After-Free Vulnerability Discovered in Linux Kernel NVMe/TCP Subsystem

    A significant use-after-free vulnerability in the NVMe/TCP subsystem of the Linux kernel has been identified, potentially allowing remote code execution or local privilege escalation.

    What changed

    A critical use-after-free vulnerability has been identified in the NVMe/TCP subsystem of the Linux kernel. This flaw arises from a logical error in the function `nvmet_tcp_free_crypto`, which could lead to severe security implications.

    The vulnerability may allow attackers to exploit the issue, potentially leading to remote code execution or local privilege escalation, thereby compromising system integrity.

    Who is affected

    This vulnerability impacts a wide range of users and systems that utilize the Linux kernel, particularly those leveraging the NVMe/TCP subsystem.

    Organizations relying on Linux-based environments for cloud services or enterprise applications may be especially vulnerable.

    • Users of the Linux kernel across various distributions.
    • Cloud service providers utilizing NVMe/TCP for storage solutions.
    • Enterprise environments that depend on Linux for critical applications.
    • Developers and system administrators managing NVMe/TCP implementations.

    What to do

    It is crucial for affected users and organizations to stay informed about this vulnerability and apply necessary mitigations.

    Updating to the latest version of the Linux kernel that addresses this vulnerability is recommended to ensure system security.

    • Monitor official channels for updates regarding the Linux kernel.
    • Implement security best practices to minimize exposure to potential exploits.
    • Conduct regular security audits to identify and address vulnerabilities in the system.