CVE-2022-3479

What it actually does

The flaw triggers a segmentation fault or process crash in NSS during client authentication when no user certificate exists in the configured database, resulting in denial of service.

Why it matters to the business

Applications and services relying on NSS for TLS may experience unexpected crashes and downtime; the issue has been public for over three years with stable low exploitation probability and no known ransomware use.

How an attack unfolds

An unauthenticated remote attacker initiates a TLS handshake that requests client authentication; by ensuring no certificate is present in the NSS database the malformed or missing certificate path triggers the crash condition.

How to fix it

Upgrade Mozilla NSS to the latest stable release that resolves the client-auth crash; where upgrades are not immediately possible, configure the application to require certificates or fall back to alternative TLS libraries until patched versions are deployed.

How to confirm the fix worked

Confirm NSS version is newer than the vulnerable release, run regression tests that perform client-auth handshakes without a local certificate, and verify the process no longer terminates with a segmentation fault.

Typical attack path

1. Identify a target service that uses NSS for TLS client authentication
2. Establish a network connection and send a TLS ClientHello requesting client certificate authentication
3. Respond to the CertificateRequest with no certificate or an empty chain
4. Trigger the NSS code path that dereferences a null or missing certificate entry causing the segmentation fault

How to detect it

Review application and system logs for NSS segmentation fault entries or abrupt process terminations during TLS client-auth handshakes; correlate with network logs showing client-auth negotiation without certificates.

What your security team should do

• Prioritize patching NSS in all internet-facing services within standard maintenance windows given the high availability impact
• Monitor upstream Mozilla advisories for the specific NSS fix version and schedule deployment
• Temporarily disable optional client-auth or enforce certificate presence where feasible to reduce exposure