{"uuid": "6e0476ed-6993-424c-922a-4680a78a5605", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39173", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/74858", "content": "Exploit Collector\nwolfSSL Buffer Overflow\n\nhttps://4.bp.blogspot.com/-yT3eHciMBDw/WWlvGfUXh9I/AAAAAAAAILU/lYidSj08G0suEfC69x80tZFrj-NYN5F9wCLcBGAs/s1600/h137.png In wolfSSL versions prior to 5.5.1, malicious clients can cause a buffer overflow during a resumed TLS 1.3 handshake. If an attacker resumes a previous TLS session by sending a maliciously crafted Client Hello, followed by another maliciously crafted Client Hello. In total 2 Client Hellos have to be sent. One which pretends to resume a previous session and a second one as a response to a Hello Retry Request message.\n\nSHA-256 | dc47311c0e4409688cd698016d1b6ec4010bff4dbccd63241e107b8a91774b58Download # wolfssl before 5.5.1: CVE-2022-39173 Buffer overflow when refining\ncipher suites\n==================================================================================\n## INFO\n=======\n\nThe CVE project has assigned the id CVE-2022-39173 to this issue.\n\nSeverity: high 7.5\nAffected version: before 5.5.1\nEnd of embargo: The embargo for this vulnerability ended 29th of September, 2022\n## SUMMARY\n==========\n\nIn wolfSSL before 5.5.1 malicious clients can cause a buffer-overflow\nduring a resumed TLS 1.3 handshake. If an attacker resumes a previous\nTLS session by sending a maliciously crafted Client Hello, followed by\nanother maliciously crafted Client Hello. In total 2 Client Hellos\nhave to be sent. One which pretends to resume a previous session and a\nsecond one as a response to a Hello Retry Request message.\n\nThe malicious Client Hellos contain a list of supported cipher suites,\nwhich contain at least `\u230asqrt(150)\u230b + 1 = 13` duplicates and less than\n150 ciphers in total. The buffer-overflow occurs in the `RefineSuites`\nfunction. An overflow of 44700 bytes has been confirmed. Therefore,\nlarge portions of the stack can get overwritten, including return\naddresses.\n\nWe confirmed the vulnerability by sending packets over TCP to a\nWolfssl server, freshly built from the sources with the\n`--enable-session-ticket` flags (or simply `--enable-all`). We can\nprovide sources for our software (tlspuffin) that produce those\npackets (and that automatically found the attack trace). The command\ngiven at the end of this document triggers the buffer overflow.\n\nIt is very likely that there is a way to craft an exploit which can\ncause a RCE. We have not yet created such an exploit as it would\nlikely depend on the memory layout of the binary which uses wolfSSL.\n\nMoreover, the size of the overflow can be fine-tuned in order to not\nsmash the stack and continue the execution with a too large length of\nsuites buffer and that will cause other routines that iterate over\nthus buffer (e.g., `FindSuiteSSL`) to misbehave. Hypothetically, this\nmight be exploited to make the server use a cipher it should not\naccept such as `nullcipher` that would open up new attack vectors such\nas downgrade attacks.\nWhile this has not been confirmed yet, the buffer overflow itself has\nbeen confirmed.\n## DETAILS\n==========\n\nLine numbers below are valid for the wolfSSL Git tag\n[v5.4.0-stable](https://github.com/wolfSSL/wolfssl/tree/v5.4.0-stable).\n\nThe bug we found is in the `RefineSuites` function. In the following\nwe want to explain why the function is able to overflow the `suites`\narray.\n```c\n/* Refine list of supported cipher suites to those common to server and client.\n*\n* ssl         SSL/TLS object.\n* peerSuites  The peer's advertised list of supported cipher suites.\n*/\nstatic void RefineSuites(WOLFSSL* ssl, Suites* peerSuites)\n{\nbyte   suites[WOLFSSL_MAX_SUITE_SZ];\nword16 suiteSz = 0;\nword16 i, j;\n\nXMEMSET(suites, 0, WOLFSSL_MAX_SUITE_SZ);\n\nfor (i = 0; i < ssl->suites->suiteSz; i += 2) {\nfor (j = 0; j < peerSuites->suiteSz; j += 2) {\nif (ssl->suites->suites[i+0] == peerSuites->suites[j+0] &&\nssl->suites->suites[i+1] == peerSuites->suites[j+1]) {\nsuites[suiteSz++] = peerSuites->suites[j+0];\nsuites[suiteSz++] = peerSuites->suites[j+1];\n}\n}\n}\n\nssl->suites->suiteSz = suiteSz;\nXMEMCPY(ssl->suites->suites, &suites, sizeof(suites));\n#ifdef WOLFSSL_DEBUG_TLS\n[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:57.568405Z"}