TLS 1.3 Certificate Parser Heap Out-of-Bounds Read in NetX Secure

Executive Summary

This vulnerability is a missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure. A malicious TLS 1.3 server can trigger an unsigned-integer underflow and a heap out-of-bounds read in any peer processing a remote Certificate message. It occurs pre-authentication during the handshake before certificate verification completes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your NetX Duo version is affected by running: nx_version_get() or examining build configurations for NX_SECURE_TLS_TLS_1_3_ENABLED. Monitor network traffic for malformed TLS 1.3 Certificate messages with oversized extensions_length fields. Use static analysis tools to inspect the TLS 1.3 Certificate-message parser for missing bounds checks.

Useful 0 Not Useful 0

Impact Analysis

This flaw allows remote attackers to cause a denial of service by crashing the application or potentially executing arbitrary code. It can be exploited without authentication or user interaction, affecting system availability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update NetX Duo to version 6.5.2.202603 or later. As a temporary workaround, disable TLS 1.3 support by setting NX_SECURE_TLS_ENABLE_TLS_1_3 to 0. Ensure all TLS 1.3 implementations are patched and monitor for suspicious network activity.

Useful 0 Not Useful 0