Real Time Logic SharkSSL Client-Hello Message heap-based overflow

Summaryinfo

A vulnerability identified as critical has been detected in Real Time Logic SharkSSL. This vulnerability affects unknown code of the component Client-Hello Message Handler. This manipulation causes heap-based overflow. This vulnerability is tracked as CVE-2024-53379. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in Real Time Logic SharkSSL (affected version not known) and classified as critical. Affected by this vulnerability is some unknown functionality of the component Client-Hello Message Handler. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect availability. The summary by CVE is:

Heap buffer overflow in the server site handshake implementation in Real Time Logic LLC's SharkSSL version (from 05/05/24) commit 64808a5e12c83b38f85c943dee0112e428dc2a43 allows a remote attacker to trigger a Denial-of-Service via a malformed Client-Hello message.

The advisory is shared at telekom.com. This vulnerability is known as CVE-2024-53379 since 11/20/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/24/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Real Time Logic

Name

• SharkSSL

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion