« Volver al listado

CVE-2024-45402

Estado: AnalizadaCrítica (9.8)—

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. When parsing a spoofed TLS handshake message, picotls (specifically, bindings within picotls that call the crypto libraries) may attempt to free the same memory twice. This double free occurs during the disposal of multiple objects without any intervening calls to malloc Typically, this triggers the malloc implementation to detect the error and abort the process. However, depending on the internals of malloc and the crypto backend being used, the flaw could potentially lead to a use-after-free scenario, which might allow for arbitrary code execution. The vulnerability is addressed with commit 9b88159ce763d680e4a13b6e8f3171ae923a535d.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Red sin autenticación (AV:N/PR:N), parsingde mensaje TLS malformado gatilla double free y potencial RCE; impacto de ejecución arbitraria confirmado por descripción.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software InstallationLimit Access to Resource Over Network

Tecnologías afectadas (1)

Dena — Picotls

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-45402",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45402",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-11T14:51:21.382378Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "h2o",
          "product": "picotls",
          "versions": [
            {
              "status": "affected",
              "version": "< 9b88159ce763d680e4a13b6e8f3171ae923a535d"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:h2o_project:picotls:*:*:*:*:*:*:*:*"
          ],
          "vendor": "h2o_project",
          "product": "picotls",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "9b88159ce763d680e4a13b6e8f3171ae923a535d",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-10-11T15:15:04.903",
  "references": [
    {
      "url": "https://github.com/h2o/picotls/commit/9b88159ce763d680e4a13b6e8f3171ae923a535d",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/h2o/picotls/security/advisories/GHSA-w7c8-wjx9-vvvv",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-415"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. When parsing a spoofed TLS handshake message, picotls (specifically, bindings within picotls that call the crypto libraries) may attempt to free the same memory twice. This double free occurs during the disposal of multiple objects without any intervening calls to malloc Typically, this triggers the malloc implementation to detect the error and abort the process. However, depending on the internals of malloc and the crypto backend being used, the flaw could potentially lead to a use-after-free scenario, which might allow for arbitrary code execution. The vulnerability is addressed with commit 9b88159ce763d680e4a13b6e8f3171ae923a535d."
    },
    {
      "lang": "es",
      "value": "Picotls es una librería de protocolo TLS que permite a los usuarios seleccionar diferentes backends criptográficos según su caso de uso. Al analizar un mensaje de protocolo de enlace TLS falsificado, picotls (específicamente, los enlaces dentro de picotls que llaman a las librerías criptográficas) pueden intentar liberar la misma memoria dos veces. Esta doble liberación ocurre durante la eliminación de múltiples objetos sin ninguna llamada intermedia a malloc. Por lo general, esto activa la implementación de malloc para detectar el error y abortar el proceso. Sin embargo, dependiendo de los componentes internos de malloc y el backend criptográfico que se use, la falla podría potencialmente conducir a un escenario de use-after-free, lo que podría permitir la ejecución de código arbitrario. La vulnerabilidad se soluciona con el commit 9b88159ce763d680e4a13b6e8f3171ae923a535d."
    }
  ],
  "lastModified": "2026-06-17T07:54:08.720",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dena:picotls:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8B44BB8-1995-4076-BA61-135AFD0E512D",
              "versionEndExcluding": "2024-10-10",
              "versionStartIncluding": "2024-08-12"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}