Listen to this Post
The CVE-2024-24770 vulnerability in pyasn1 v0.6.1 involves a Denial-of-Service due to memory exhaustion during BER decoding of RELATIVE-OID objects. In the decoder at line 496 of pyasn1/codec/ber/decoder.py, the code `reloid += ((subId << 7) + nextSubId,)` processes continuation octets without bounds. A malicious RELATIVE-OID with excessive continuation octets, such as a long sequence of `0x81` bytes, causes the decoder to repeatedly shift and add sub-identifiers, leading to exponential memory growth. This occurs when decoding ASN.1 data structures like X.509 certificates, where each continuation octet expands the integer representation, consuming all available memory. The lack of limits allows small payloads to trigger massive memory allocation, hanging systems or stopping services like LDAP servers, TLS/SSL endpoints, and OCSP responders.
Platform: pyasn1
Version: v0.6.1
Vulnerability: Memory exhaustion DoS
Severity: Critical
date: Not specified
Prediction: Patch expected soon
What Undercode Say:
Analytics:
python3 -c "
import pyasn1.codec.ber.decoder as decoder
import pyasn1.type.univ as univ
payload = b'\x81' (100 1024 1024) + b'\x00'
length = len(payload)
if length < 128:
length_bytes = bytes([bash])
else:
length_bytes = b'\x84' + length.to_bytes(4, 'big')
malicious_packet = b'\x06' + length_bytes + payload
result = decoder.decode(malicious_packet, asn1Spec=univ.ObjectIdentifier())
print('Decoded:', result)
"
From PoC import resource resource.setrlimit(resource.RLIMIT_AS, (10010241024, 10010241024)) payload = b'\x81' (10 1024 1024) + b'\x00' DER encoding and decoding as above
how Exploit:
Attacker crafts malicious X.509 certificate with malformed RELATIVE-OID containing excessive continuation octets. Application validates certificate, decodes it via pyasn1 BER decoder, triggering memory exhaustion and DoS.
Protection from this CVE:
Add limit allowed bytes decoder. Update pyasn1 patched version.
Impact:
Resource consumption hang systems. Affect LDAP servers TLS endpoints OCSP responders.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
