REDHAT-BUG-2435258: Null Pointer Dereference

Summarysummary A malicious TLS client can trigger a NULL pointer dereference on the server by sending a crafted ClientHello message with an invalid PSK binder value. This leads to a server crash and constitutes a remote Denial-of-Service condition.

Technical Detailstechnical-details The issue occurs during PSK binder verification in the server-side code path.

In presharedkey.c, when the server receives a presharedkey extension, the function gnutlspskrecvparams() is invoked. Under certain conditions, the following logic is executed:

pskcred = (gnutlspskservercredentialst) gnutlsgetcred(session, GNUTLSCRDPSK); if (pskcred == NULL && (session->internals.flags & GNUTLSNOTICKETS)) return 0; return serverrecvparams(session, data, len, pskcred); When the server issues a NewSessionTicket and the client later sends a ClientHello using the ticket identity from that message, gnutlsgetcred() returns NULL. However, in this scenario the conditional check above does not return early, and pskcred (which is NULL) is passed to serverrecvparams().

Inside serverrecvparams(), the PSK binder value is verified. If the received binder size matches the PRF MAC length but the binder value itself is incorrect, the following code path is taken:

if (gnutlsmacgetalgolen(prf) != binderrecvd.size || gnutlsmemcmp(bindervalue, binderrecvd.data, binderrecvd.size)) { if (pskcred->binderalgo == NULL && mac == GNUTLSMACSHA384) { mac = GNUTLSMACSHA256; gnutlsfreekeydatum(&key); goto retrybinder; } gnutlsassert(); ret = GNUTLSERECEIVEDILLEGALPARAMETER; goto fail; } At this point, pskcred is NULL, and dereferencing pskcred->binderalgo results in a NULL pointer dereference and crashes the server.

Security Impactsecurity-impact An unauthenticated remote client can reliably crash a gnuTLS-based TLS server by sending a malformed ClientHello with incorrect PSK binder values. This constitutes a remote Denial-of-Service vulnerability.

Proof of Conceptproof-of-concept Due to ongoing research constraints, I am unable to publicly disclose the PoC at this time. However, I can provide a minimal Python-based PoC privately upon request to assist with verification and debugging.

Priority Argument Settingspriority-argument-settings For completeness, the following priority string was used in my test environment: This priority configuration is specific to my research and experimental setup. However, the NULL pointer dereference does not depend on this particular priority string. In a more typical configuration, as long as the server issues a NewSessionTicket and a malicious client subsequently sends a ClientHello that references the ticket identity with an invalid PSK binder, the same NULL pointer dereference condition can still be triggered.

In other words, the issue is inherent to the server-side PSK binder handling logic and is not limited to this experimental priority configuration.