CVE-2024-28835

What it actually does

A specially crafted PEM bundle triggers a crash in the certificate verification path when processed via the certtool --verify-chain command, resulting in denial of service.

Why it matters to the business

Local users or automated processes handling untrusted certificate bundles can cause the verification tool to crash, disrupting certificate management workflows on affected systems until patched.

How an attack unfolds

An attacker with local access crafts a malicious PEM bundle and supplies it to the certtool --verify-chain command, causing the application to crash and denying service to the verification operation.

How to fix it

Upgrade libsndfile-devel on AlmaLinux 8 to version 1.0.28-10.el8 or later. Restrict local execution of certtool to trusted users until the update is applied.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the fixed release, then test certificate verification with known-good bundles to ensure the crash no longer occurs.

Typical attack path

1. Obtain local access to a system with the vulnerable package installed
2. Create or obtain a specially crafted PEM bundle designed to trigger the flaw
3. Execute certtool --verify-chain against the malicious bundle
4. Observe application crash and resulting denial of service

How to detect it

Review system logs and process execution records for invocations of certtool --verify-chain that terminate abnormally; correlate with file access to untrusted PEM bundles.

What your security team should do

• Apply the vendor-supplied update to libsndfile-devel immediately on all AlmaLinux 8 systems
• Audit local users and scripts that invoke certtool with untrusted input
• Monitor for future updates given the stable but non-zero EPSS score