CVE-2023-3724
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
CVE-2023-3724 affects TLS 1.3 clients that do not receive a PSK or KSE extension when connecting to a malicious server. In this case, a default predictable buffer is used for the IKM value, which may lead to session key compromise.
Risk Assessment
Compromise of the session key may allow an eavesdropper to reconstruct the key and potentially access or meddle with message contents in the session. While it does not affect server validation, it could result in an insecure TLS 1.3 session.
Recommendation
It is recommended that TLS 1.3 client users update the version of wolfSSL they are using to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a malicious server, a default predictable buffer gets used for the IKM (Input Keying Material) value when generating the session master secret. Using a potentially known IKM value when generating the session master secret key compromises the key generated, allowing an eavesdropper to reconstruct it and potentially allowing access to or meddling with message contents in the session. This issue does not affect client validation of connected servers, nor expose private key information, but could result in an insecure TLS 1.3 session when not controlling both sides of the connection. wolfSSL recommends that TLS 1.3 client side users update the version of wolfSSL used.