REDHAT-BUG-2467279: High severity OpenSSL DTLS packet ordering (qsort comparator) vulnerability
The comparator function used for ordering DTLS packets by sequence numbers did not follow qsort comparator contracts in case of packets with duplicate sequence numbers, which could lead to unstable ordering or undefined behaviour. Return 0 in such cases makes the sorting stable. Additionally, discard packets with same sequence numbers and differing handshake type, so that they don't end up being sorted in the first place.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the comparator function used for ordering DTLS packets by sequence numbers to return 0 when sequence numbers are equal so the comparator follows qsort comparator contracts and makes the sorting stable.
comparator function used for ordering DTLS packets by sequence numbers qsort comparator behavior for duplicate sequence numbers = return 0 for packets with duplicate sequence numbers - Configuration
Discard packets that have the same sequence numbers but differing handshake type so they do not get sorted by the comparator in the first place.
DTLS packet processing handling of packets with same sequence numbers and differing handshake type = discard packets with same sequence numbers and differing handshake type
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2467279?
The severity of REDHAT-BUG-2467279 is rated as high with a score of 7.
What risk is associated with REDHAT-BUG-2467279?
REDHAT-BUG-2467279 has an associated risk score of 33.
How do I fix REDHAT-BUG-2467279?
To fix REDHAT-BUG-2467279, update to the patched version of OpenSSL that addresses the comparator function issues.
What problem does REDHAT-BUG-2467279 highlight in OpenSSL?
REDHAT-BUG-2467279 highlights issues in the qsort comparator used for DTLS packet ordering which may lead to unstable sorting.
What can result from the instability described in REDHAT-BUG-2467279?
The instability from REDHAT-BUG-2467279 can result in undefined behavior when processing DTLS packets with duplicate sequence numbers.