wolfSSL PKCS7 Indefinite-Length Parsing Heap Out-of-Bounds Read Vulnerability

A heap out-of-bounds read vulnerability has been identified in wolfSSL's PKCS7 message parsing. This issue arises from a missing bounds check in the indefinite-length end-of-content verification loop within the PKCS7_VerifySignedData() function. A crafted PKCS7 message can exploit this flaw, leading to an out-of-bounds read on the heap.

Impact

Exploitation of this vulnerability causes a heap out-of-bounds read, which can potentially be leveraged for further attacks, such as memory corruption or information disclosure.

Remediation

Users are advised to update to the latest version of wolfSSL, where this vulnerability has been addressed. Instructions for updating can be found in the wolfSSL documentation.