CVE-2024-12243

What it actually does

Inefficient ASN.1 DER decoding algorithm in libtasn1 causes GnuTLS to consume excessive CPU time when processing specially crafted certificates, leading to unresponsiveness or slowdown.

Why it matters to the business

Remote attackers can disrupt availability of services relying on GnuTLS, causing outages or degraded performance for users and systems that depend on secure connections.

How an attack unfolds

An attacker generates a malicious DER-encoded certificate designed to trigger the slow parsing path in libtasn1 and delivers it to a GnuTLS-based server during a TLS handshake or certificate validation.

How to fix it

Update GnuTLS and its libtasn1 dependency to versions containing fixes for the ASN.1 decoding performance issue; apply vendor patches as they become available and rebuild dependent applications.

How to confirm the fix worked

Test certificate processing performance with known trigger inputs before and after updates; monitor resource usage during TLS operations and verify updated library versions are in use.

Typical attack path

1. Craft a DER certificate that exploits the inefficient libtasn1 algorithm
2. Deliver the certificate to a target GnuTLS instance via TLS handshake or certificate exchange
3. Trigger repeated or sustained decoding operations to exhaust resources
4. Cause service slowdown or denial of service

How to detect it

Review system and application logs for prolonged TLS handshake durations or high CPU utilization in GnuTLS processes; correlate with incoming connections presenting unusual certificates.

What your security team should do

• Track and apply updates to GnuTLS and libtasn1 promptly
• Implement connection rate limiting and timeouts on TLS endpoints
• Monitor for anomalous CPU spikes during certificate validation