Junglewise Threat Intelligence

CVE-2024-12133: GNU libtasn1 denial of service via inefficient DER decoding

CVE-2024-12133 · Severity: medium · CVSS 5.3 · Published 2025-02-10

Technologies: Debian, Red Hat Enterprise Linux. Vendors: Gnu, Debian, Red Hat.

Executive brief

A vulnerability in the libtasn1 library, which is used to process digital certificates and security structures, can allow an attacker to crash or significantly slow down a system. By sending a specially crafted certificate with a large number of elements, an attacker can force the system to spend excessive time processing the data. This results in a denial-of-service, potentially disrupting secure communications or services that rely on certificate validation.

Technical details

A vulnerability classified as Inefficient Algorithmic Complexity (CWE-407) exists in libtasn1 during the decoding of Distinguished Encoding Rules (DER) data. The root cause is the inefficient handling of specific certificate structures containing a large number of elements, which leads to exponential or high-order polynomial processing time. A remote, unauthenticated attacker can exploit this by providing a specially crafted ASN.1/DER encoded certificate to an application using the library. Successful exploitation results in excessive CPU consumption, leading to a denial-of-service (DoS) condition. Patches have been released by Red Hat, Debian, and the upstream GnuTLS/libtasn1 project.

Affected products

  • GNU libtasn1 4.13, 4.16.0
  • Red Hat Enterprise Linux 8, 9.2
  • Debian Debian LTS

Timeline

  • 2025-02-06: disclosed: Initial disclosure on oss-security mailing list
  • 2025-02-10: advisory: NVD publication and Red Hat initial CVE assignment
  • 2025-04-22: patched: Red Hat Enterprise Linux 8 patch released (RHSA-2025:4049)
  • 2025-10-06: patched: Red Hat Enterprise Linux 9.2 patch released (RHSA-2025:17347)

References