CVE-2024-35255

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A race condition vulnerability (CVE-2024-35255) has been identified in the Azure Identity library for .NET and the underlying Microsoft Authentication Library (MSAL), distributed as the out-of-band Azure.Identity NuGet package, which allows a low-privileged local attacker to elevate privileges. A concurrent process running on the same host can exploit a timing window in the credential and token cache access path to read authentication material belonging to another user or process.

Per CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), a race condition occurs when the product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

This issue affects applications that reference the Azure.Identity package in versions prior to 1.11.4. The package is opt-in and out-of-band; it is not part of the .NET shared framework, so only applications that reference it, directly or transitively, are exposed.

‍

Details

Module Info

• Product: .NET applications referencing the Azure Identity library (Azure.Identity), directly or transitively
• Affected packages:
  
  • Azure.Identity
  • Microsoft.Identity.Client
• Affected versions:
  
  • Azure.Identity < 1.11.4
  • Microsoft.Identity.Client >= 4.49.1 < 4.60.4, >= 4.61.0 < 4.61.3
• GitHub repository: https://github.com/Azure/azure-sdk-for-net
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager: NuGet
• Fixed in: NES for .NET 6.0.42

Vulnerability Info

This Medium-severity vulnerability is found in the Azure.Identity package and the Microsoft.Identity.Client (MSAL) library it relies on. Both libraries maintain a shared credential and token cache that can be accessed by more than one process on the same machine. A time-of-check to time-of-use timing window exists in the cache access path: because concurrent reads and writes are not fully synchronized, a low-privileged local attacker running a second process can act inside that window to observe or interfere with cached credentials and authentication tokens that belong to another user or process, and thereby elevate privileges on the host. The vector is local only; there is no network-reachable exploitation path, and no user interaction is required. In NES for .NET 6.0, Azure.Identity is reached transitively through Microsoft.Extensions.Caching.SqlServer → Microsoft.Data.SqlClient → Azure.Identity. NES for .NET 6.0.42 closes this path by advancing Microsoft.Data.SqlClient (2.1.7 → 5.2.2), which brings in patched Azure.Identity (≥ 1.11.4) and Microsoft.Identity.Client (≥ 4.61.3) transitives. Known limitation: applications that reference Microsoft.EntityFrameworkCore.SqlServer reach MSAL through a separate dependency chain that still resolves to Microsoft.Identity.Client 4.21.1 in 6.0.42 and therefore remain exposed to this vulnerability; that path is addressed in a subsequent NES for .NET 6.0 release. Applications on the EF Core SqlServer path should apply the package-level mitigation below (pin Microsoft.Identity.Client ≥ 4.61.3) in the interim.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • Azure.Identity >= 1.11.4
  • Microsoft.Identity.Client >= 4.61.3
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.42 or later.

‍

Credits

• Microsoft (finder)