Mozilla has patched a critical bug present in the NSS (Network Security Services) cross-platform cryptographic library that could be potentially abused by threat actors to crash a susceptible device and even implement arbitrary code.
The vulnerability tracked as CVE-2021-43527, was discovered by Tavis Ormandy, a renowned bug-hunter with Google Project Zero who named the flaw “BigSig.”
“I've discovered a critical vulnerability in Network Security Services (NSS). NSS is the Mozilla project's cross-platform cryptography library. In 2021, all good bugs need a catchy name, so I'm calling this one "BigSig",” Ormandy explained in a blog post.
According to Ormandy, the flaw could have directed to a heap-based buffer overflow while verifying DER-encoded DSA or RSA-PSS signatures in multiple email users and PDF viewers that use the NSS versions prior to 3.73 or 3.68.1 ESR.
All applications that depend on NSS for managing signatures encoded within CMS, PKCS #7, PKCS #12, and S/MIME are likely to be impacted, Mozilla said in an advisory. Additionally, the vulnerability may also affect applications that employ NSS for validating certificates, or for additional CRL, OCSP, TLS, or X.509 functionality, depending on how NSS is configured. The exploitation of the flaw could allow an attacker to crash an application or potentially achieve arbitrary code execution.
“This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted,” Mozilla says.
The vulnerability exists because a VFYContext structure that NSS manufactures to store data when verifying a digital signature could only accommodate maximum signature sizes of 16384 bits (RSA at 2048 bytes). Thus, signatures larger than that would lead to a buffer overflow, Ormandy explained.
“The untrusted signature is simply copied into this fixed-sized buffer, overwriting adjacent members with arbitrary attacker-controlled data,” Ormandy said. The security researcher also observed that the security bug can be easily reproduced and that multiple algorithms are affected.
“The bug is that there are simply no bounds checking at all; sig and key are arbitrary-length, attacker-controlled blobs, and cx->u is a fixed-size buffer. The hashobj member contains function pointers, so redirecting execution is trivial,” Ormandy concluded.
