X.509DoS AttackX.509DoS: Exploiting and Detecting Denial-of-Service Vulnerabilities in Cryptographic Libraries using Crafted X.509 Certificates

News

Introduction

X.509DoS represents a class of denial-of-service (DoS) attacks that exploit vulnerabilities in the implementation of parsing or validation of X.509 certificates. Since these processes typically occur before signature verification, an attacker can craft malicious certificates without requiring access to the private key for re-signing. Therefore, any project that uses X.509-related APIs from cryptographic libraries with implementation vulnerabilities and attempts to handle certificates from untrusted external sources may be vulnerable to the X.509DoS attack. Given the widespread use of X.509 certificates in public key infrastructure (PKI), various scenarios could introduce the X.509DoS threat, including TLS handshakes, application signature verification, and more.

Paper

Bing Shi, Wenchao Li, Yuchen Wang, Xiaolong Bai, and Luyi Xing. X.509DoS: Exploiting and Detecting Denial-of-Service Vulnerabilities in Cryptographic Libraries using Crafted X.509 Certificates. In 34th USENIX Security Symposium (USENIX Security 25)

Q & A

Q. What is X.509DoS attack?

A. X.509DoS represents a class of DoS attacks that exploit vulnerabilities in the implementation of parsing or validation of X.509 certificates. By crafting malicious certificates, an attacker can send them to the party responsible for handling certificates in specific scenarios, thereby turning it into a victim of a DoS attack.

Q. What are some typical scenarios where X.509DoS attacks could be launched?

A. Some typical scenarios include:

The second and third points mentioned above can also be combined to launch a remote DoS attack based on S/MIME emails. For further details, please refer to our attack example targeting Apple's macOS: Banana Mail.

Q. Are the vulnerabilities exploited in X.509DoS attacks directly related to X.509 certificates?

A. Not necessarily. In fact, the vulnerabilities exploited by X.509 DoS attacks primarily reside in three types of modules within the cryptographic libraries: the mathematical module, the ASN.1 module, and the X.509 module. The X.509 module provides implementations for operations such as certificate chain validation, and vulnerabilities within this module can be considered directly related to X.509 certificates. However, the first two modules primarily provide implementations for mathematical operations required by cryptographic algorithms and the encoding/decoding of ASN.1 objects. These implementations may not be directly related to X.509 certificates, but vulnerabilities within them can often be exploited by X.509 certificates.

Q. Does the crafted certificate need to be issued by a trusted CA?

A. No, the attack occurs during certificate parsing or validation, which happens before the certificate's signature is verified. This makes the attack independent of whether the certificate is signed by a trusted CA. As a result, the attacker does not need a certificate from a trusted CA; self-signed certificates are sufficient to launch this type of attack.

Q. Which types of DoS attacks does X.509DoS focus on?

A. X.509DoS primarily focuses on the following three specific types of DoS attacks:

Q. What vulnerabilities could potentially be exploited to launch X.509DoS attacks?

A. We discovered 18 new vulnerabilities during this process, the details of which are presented in Table 3 of our paper. Additionally, we have listed 12 previously known vulnerabilities in Table 4 of the paper. These vulnerabilities can be viewed as examples that could be potentially exploited to launch X.509DoS attacks.

Q. How to minimize the introduction of X.509DoS threats for cryptographic library developers?

A. Here are some strategies for reference:

Q. Are there other attack vectors that could lead to similar impacts as crafted X.509 certificates?

A. Yes, many vulnerable implementations are not necessarily limited to the processing of X.509 certificates. Other commonly used materials in PKI, such as public key files and certificate signing requests (CSRs), may also trigger these vulnerabilities. Additionally, ASN.1-related vulnerabilities may be triggered during certain protocol interactions.

Contact