wolfSSL TLS 1.3 Post-Quantum Cryptography Hybrid KeyShare Heap Use-After-Free Vulnerability

A heap use-after-free vulnerability has been identified in wolfSSL's TLS 1.3 post-quantum cryptography hybrid KeyShare processing. The issue arises in the error handling path of the function TLSX_KeyShare_ProcessPqcHybridClient(), where a KyberKey object is freed upon encountering an error. Subsequently, the caller invokes TLSX_KeyShare_FreeAll(), which attempts to access the already-freed KyberKey, leading to unauthorized writes over freed heap memory.

Impact

Exploitation of this vulnerability can lead to a heap use-after-free condition, allowing for potential memory corruption.

Remediation

Users are advised to update to the latest version of wolfSSL, where this vulnerability has been addressed.