Erlang/OTP SSL Certificate Chain DoS Vulnerability Fix Analysis

Vulnerability Overview This vulnerability relates to issues in the SSL/TLS certificate chain building process, potentially leading to Denial of Service (DoS) attacks. Specifically, handling redundant and unordered certificates may result in cycles, triggering a DoS attack. Additionally, depth limit checks for building chain length have been introduced. Impact Scope Affected Components: and Affected Versions: OTP-27.3.4.15 Remediation 1. Add Depth Limit Checks: - Added depth limit checks for the built chain length in the function to prevent issues caused by excessively long chains. 2. Ensure Robust Certificate Chain Building Using Directed Graphs: - Introduced the module to ensure more robust certificate chain building, avoiding issues with cycles and redundant certificates. - Added the function to generate candidate paths, ensuring the correctness and completeness of the paths. 3. Update Test Cases: - Added multiple test cases in , including and , to verify that the patched code can correctly handle malicious cycles and unordered certificate chains. Proof of Concept (PoC) Code The following is an extraction of some key code snippets: ```erlang % lib/ssl/src/ssl_certificate.erl %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, CertsDBRef, Chain, ListDB} | %% {error, Reason} %% @end %% @doc build_certificate_chain/3 %% @end %% @spec build_certificate_chain(Cert, CertDBHandle, CertsDBRef, Chain, ListDB) -> %% {ok, CertDBHandle, Cer

Goal Reached Thanks to every supporter — we hit 100%!

Erlang/OTP SSL Certificate Chain DoS Vulnerability Fix Analysis

More from this source