CVE-2023-25824 (published 2023-02-23T22:15Z)

Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 (including) did not properly fail blocking read operations on TLS connections when the transport hit timeouts. Instead it entered an endless loop retrying the read operation, consuming CPU resources. This could be exploited for denial of service attacks. If trace level logging was enabled, it would also produce an excessive amount of log output during the loop, consuming disk space. The problem has been fixed in commit d7eec4e598158ab6a98bf505354e84352f9715ec, please update to version 0.12.1. There are no workarounds, users who cannot update should apply the errno fix detailed in the security advisory. \n

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/airtower-luna/mod_gnutls
commit_details: repo_url: https://github.com/airtower-luna/mod_gnutls
author: Fiona Klute
author_date: 2023-02-23 11:55:53+01:00
msg: Fix loop in blocking read on transport timeout

The loop was cased by an incorrect errno if the transport read in
mgs_transport_read() fails with an APR TIMEUP status, as happens when
mod_reqtimeout limits are exceeded. Setting the transport errno to
EGAIN meant that a blocking read would be retried endlessly, setting
ETIMEDOUT instead makes the read fail as it should.

The bug was introduced in commit 92cb0cca41af946055307e373b6ab6d76d34f356,
first release to include it was 0.9.0.

Many thanks to Félix Arreola Rodríguez for the detailed analysis [1]
on the Debian bug tracker!

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942737#25
repository: repo_url: https://github.com/airtower-luna/mod_gnutls
repo_name: airtower-luna/mod_gnutls
description: TLS module for Apache HTTPD based on GnuTLS
repo_language: C
owner: airtower-luna
file_changes: filename: gnutls_io.c
change_type: ModificationType.MODIFY
diff: @@ -2,7 +2,7 @@
  *  Copyright 2004-2005 Paul Querna
  *  Copyright 2008 Nikos Mavrogiannopoulos
  *  Copyright 2011 Dash Shendy
- *  Copyright 2015-2020 Fiona Klute
+ *  Copyright 2015-2022 Fiona Klute
  *
  *  Licensed under the Apache License, Version 2.0 (the "License");
  *  you may not use this file except in compliance with the License.
@@ -277,6 +277,11 @@ static apr_status_t gnutls_io_input_read(mgs_handle_t * ctxt,
                         gnutls_alert_get_name(rc));
                 ctxt->input_rc = APR_EGENERAL;
                 break;
+            } else if (rc == GNUTLS_E_PULL_ERROR
+                       && APR_STATUS_IS_TIMEUP(ctxt->input_rc)) {
+                ap_log_cerror(
+                    APLOG_MARK, APLOG_TRACE2, ctxt->input_rc, ctxt->c,
+                    "%s: transport read timed out", __func__);
             } else {
                 /* Some Other Error. Report it. Die. */
                 if (gnutls_error_is_fatal(rc)) {
@@ -1003,7 +1008,7 @@ ssize_t mgs_transport_read(gnutls_transport_ptr_t ptr,
             && APR_BRIGADE_EMPTY(ctxt->input_bb))
         {
             ctxt->input_rc = rc;
-            gnutls_transport_set_errno(ctxt->session, EAGAIN);
+            gnutls_transport_set_errno(ctxt->session, ETIMEDOUT);
             return -1;
         }
 

programming_language: C