Description
libspdm is a sample implementation that follows the DMTF SPDM specifications. A vulnerability has been identified in SPDM session establishment in libspdm prior to version 2.3.1. If a device supports both DHE session and PSK session with mutual authentication, the attacker may be able to establish the session with `KEY_EXCHANGE` and `PSK_FINISH` to bypass the mutual authentication. This is most likely to happen when the Requester begins a session using one method (DHE, for example) and then uses the other method's finish (PSK_FINISH in this example) to establish the session. The session hashes would be expected to fail in this case, but the condition was not detected. This issue only impacts the SPDM responder, which supports `KEY_EX_CAP=1 and `PSK_CAP=10b` at same time with mutual authentication requirement. The SPDM requester is not impacted. The SPDM responder is not impacted if `KEY_EX_CAP=0` or `PSK_CAP=0` or `PSK_CAP=01b`. The SPDM responder is not impacted if mutual authentication is not required. libspdm 1.0, 2.0, 2.1, 2.2, 2.3 are all impacted. Older branches are not maintained, but users of the 2.3 branch may receive a patch in version 2.3.2. The SPDM specification (DSP0274) does not contain this vulnerability.
EPSS Score:
0%
Comprehensive Technical Analysis of EUVD-2023-35451
1. Vulnerability Assessment and Severity Evaluation
The vulnerability identified in libspdm prior to version 2.3.1 allows an attacker to bypass mutual authentication during the SPDM session establishment. This vulnerability is critical because it compromises the integrity and confidentiality of the session, potentially leading to unauthorized access and data breaches.
Severity Evaluation:
- Base Score: 9.1 (CVSS:3.1)
- Vector String: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The high base score indicates a severe vulnerability due to the following factors:
- Attack Vector (AV): Adjacent network
- Attack Complexity (AC): Low
- Privileges Required (PR): Low
- User Interaction (UI): None
- Scope (S): Changed
- Confidentiality (C), Integrity (I), Availability (A): All High
2. Potential Attack Vectors and Exploitation Methods
Attack Vectors:
- Adjacent Network Attack: An attacker on the same network can exploit this vulnerability.
- Man-in-the-Middle (MitM) Attack: An attacker can intercept and manipulate the session establishment process.
Exploitation Methods:
- Session Manipulation: The attacker can manipulate the session establishment by starting with a DHE session and finishing with a PSK session, bypassing mutual authentication.
- Hash Mismatch: The attacker exploits the condition where session hashes are expected to fail but are not detected, allowing the session to be established without proper authentication.
3. Affected Systems and Software Versions
Affected Software:
- libspdm versions 1.0, 2.0, 2.1, 2.2, and 2.3
Conditions for Impact:
- The SPDM responder supports both
KEY_EX_CAP=1andPSK_CAP=10bwith mutual authentication. - The SPDM responder is not impacted if
KEY_EX_CAP=0,PSK_CAP=0, orPSK_CAP=01b, or if mutual authentication is not required.
4. Recommended Mitigation Strategies
Immediate Actions:
- Upgrade: Upgrade to libspdm version 2.3.2 or later, which includes the patch for this vulnerability.
- Configuration: Ensure that the SPDM responder does not support both
KEY_EX_CAP=1andPSK_CAP=10bsimultaneously if mutual authentication is required.
Long-Term Strategies:
- Regular Audits: Conduct regular security audits and vulnerability assessments.
- Network Segmentation: Implement network segmentation to limit the attack surface.
- Monitoring: Enhance monitoring and logging to detect any unusual session establishment activities.
5. Impact on European Cybersecurity Landscape
This vulnerability poses a significant risk to European organizations relying on libspdm for secure device management. The potential for unauthorized access and data breaches can lead to financial losses, reputational damage, and compliance issues. The high severity score underscores the need for immediate attention and mitigation efforts across the European cybersecurity landscape.
6. Technical Details for Security Professionals
Vulnerability Details:
- CVE ID: CVE-2023-31127
- GSD ID: GSD-2023-31127
- Assigner: GitHub_M
Technical Context:
- libspdm: A sample implementation following the DMTF SPDM specifications.
- SPDM Specification (DSP0274): Does not contain this vulnerability, indicating it is specific to the libspdm implementation.
References:
ENISA IDs:
- Product: libspdm < 2.3.2
- Vendor: DMTF
Conclusion: This vulnerability in libspdm highlights the importance of robust session management and mutual authentication mechanisms. Organizations should prioritize upgrading to the patched version and implementing additional security measures to mitigate the risk. Continuous monitoring and regular updates are essential to maintain a secure cybersecurity posture.