CVE-2024-21502 Uninitialized Variable in fastecdsa
An attacker can cause denial of service in the fastecdsa library by exploiting an uninitialized variable vulnerability that leads to memory corruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-21502?
CVE-2024-21502 is a high-severity memory corruption vulnerability in fastecdsa, published on 24 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variable's actual value it could be arbitrary free(), arbitrary realloc(), null pointer dereference and other. Since the stack can be controlled by the attacker, the vulnerability could be used to corrupt allocator structure, leading to possible heap exploitation. The attacker could cause denial of service by exploiting this vulnerability.
Which versions are affected by CVE-2024-21502?
3 open source packages ship an affected version, including fastecdsa. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fastecdsa PyPI | All versions | 2.3.2 |
fastecdsa PyPI | All versions | 2.3.2 |
fastecdsa PyPI | All versions | 2.3.2 |
Products include Antonkueltz Fastecdsa.
How do I fix CVE-2024-21502?
Upgrade fastecdsa to 2.3.2 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-21502 being exploited?
There is no known exploitation of CVE-2024-21502 in the wild and no public exploit code.
Other vulnerabilities in fastecdsa
Sources
Also known as GHSA-ph86-g9r3-5qw4, PYSEC-2024-39.