PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm. At its heart, this uses timing information based on the processor's high resolution timer (the RDTSC instruction). This instruction can be virtualized, and some virtual machine hosts have chosen to disable this instruction, returning 0s or predictable results.
Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted X.509 certificates. NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2014-9744 for the ClientHello message issue.
The asn1getsequenceof function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.
A Security Bypass vulnerability exists in PolarSSL 0.99pre4 through 1.1.1 due to a weak encryption error when generating Diffie-Hellman values and RSA keys.
The ssldecryptbuf function in library/ssltls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit.
PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly perform Montgomery multiplication, which might allow remote attackers to conduct a timing side-channel attack and retrieve RSA private keys.
From the PolarSSL Security Advisory 2013-03 advisory:
"A bug in the logic of the parsing of PEM encoded certificates in x509parsecrt() can result in an infinite loop, thus hogging processing power."
A remote attacker could use this flaw to make a TLS/SSL server using PolarSSL consume an excessive amount of CPU.
This issue was corrected in PolarSSL versions 1.1.7 and 1.2.8. (Versions prior to these are affected.)
External References:
https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03
From the PolarSSL Security Advisory 2013-03 advisory:
"A bug in the logic of the parsing of PEM encoded certificates in x509parsecrt() can result in an infinite loop, thus hogging processing power."
A remote attacker could use this flaw to make a TLS/SSL server using PolarSSL consume an excessive amount of CPU.
This issue was corrected in PolarSSL versions 1.1.7 and 1.2.8. (Versions prior to these are affected.)
External References:
https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03
The Diffie-Hellman key-exchange implementation in dhm.c in PolarSSL before 0.14.2 does not properly validate a public parameter, which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic, a related issue to CVE-2011-5095.