CVE-2021-4044

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It offers an event-driven, non-blocking I/O model and is widely used in server-side applications.

A denial of service vulnerability (CVE-2021-4044) has been identified in the OpenSSL library bundled with the Node.js 17.x release line. Internally, libssl calls X509_verify_cert() on the client side to verify a certificate supplied by a server. When that function returns a negative value to signal an internal error, such as an out-of-memory condition, OpenSSL mishandles the result: the I/O function does not report success and a following call to SSL_get_error() returns SSL_ERROR_WANT_RETRY_VERIFY. Because almost no application expects that value, the outcome can be a crash, an infinite loop, or another incorrect response.

Per MITRE, CWE-835 (Loop with Unreachable Exit Condition) describes a product that "contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop." Where the calling application retries on the unexpected status, the handshake loop never terminates and the process consumes CPU or memory until it becomes unresponsive.

This issue affects Node.js versions 17.0.0 through 17.2.0. It was fixed upstream in Node.js 17.3.0, which bundles OpenSSL 3.0.1.

Details

Module Info

• Product: Node.js
• Affected packages: node (the Node.js runtime, through its bundled OpenSSL library)
• Affected versions: >=17.0.0 <17.3.0
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://github.com/nodejs/node/releases
• Package manager: npm
• Fixed in: NES for Node.js v16.20.3 (July 30, 2024)

Vulnerability Info

This High-severity vulnerability is found in the OpenSSL 3.0.0 library bundled with the Node.js 17.x release line, which was the first Node.js line to ship OpenSSL 3.0. The Node.js 14.x and 16.x lines bundle OpenSSL 1.1.1 and are not affected, and Node.js 18.0.0 and later ship OpenSSL 3.0.2 or newer, which already contain the fix.

Note: NES for Node.js v16.20.3 (July 30, 2024) is the version listed in Fixed In above even though the CVE's own affected range is the Node.js 17.x line. HeroDevs' NES for Node.js rebased its 16.x post-EOL line onto OpenSSL 3.0.x, and v16.20.3 shipped the entire OpenSSL 3.0 CVE backlog, including this issue, for that line. Upstream Node.js 16.x itself still bundles OpenSSL 1.1.1 and was never exposed to this defect; NES customers on the 16.x line scan for this CVE ID against the bundled OpenSSL and should apply v16.20.3.

Under normal operation, the status SSL_ERROR_WANT_RETRY_VERIFY is only supposed to be returned by SSL_get_error() when the application has previously installed its own certificate verification callback with SSL_CTX_set_cert_verify_callback(), asking OpenSSL to suspend the handshake so that verification can be retried. See the OpenSSL SSL_get_error documentation for the defined status values.

Because libssl does not distinguish a negative (internal error) return from X509_verify_cert() from a legitimate retry request, an internal verification failure is surfaced to the application as a retry request instead of as an error. Applications that never registered a verification callback receive a status they were never written to handle, and the resulting behavior is application dependent: an aborted process, a handshake loop that never completes, or a misreported connection state.

The impact is larger in combination with a separate OpenSSL 3.0 defect that causes X509_verify_cert() to report an internal error while processing a certificate chain in which a certificate omits the Subject Alternative Name extension and a Certificate Authority in the chain enforces name constraints. That condition can arise with otherwise valid chains, so an attacker able to influence the certificate a Node.js TLS client receives can reach the mishandled code path remotely and induce the incorrect behavior. NVD scores the issue CVSS v3.1 7.5 with availability-only impact (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Note: The defect is on the client side of TLS, where libssl verifies a server-supplied certificate. Applications that deliberately call SSL_CTX_set_cert_verify_callback() already expect SSL_ERROR_WANT_RETRY_VERIFY and handle it correctly.

Note: The OpenSSL project rated this issue Moderate under its own security policy, while NVD assigns a CVSS v3.1 base score of 7.5 (High). The band word used in this entry follows the NVD score.

Mitigation

The Node.js 17.x release line is End-of-Life and will not receive any further updates. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Update to a patched, supported Node.js release. The upstream fix shipped in Node.js 17.3.0, which bundles OpenSSL 3.0.1.
• Migrate affected applications off the End-of-Life Node.js release line.
• Leverage a commercial support partner like HeroDevs for post-EOL security support (NES for Node.js v16.20.3, released July 30, 2024).

Credits

• Tobias Nießen (reporter)
• Matt Caswell (remediation developer)