CVE-2021-28484: Loop with Unreachable Exit Condition ('Infinite Loop')

February 15, 2022 (updated April 12, 2022)

An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler does not validate the length of the request, which can lead to a state where yubihsm-connector becomes stuck in a loop waiting for the YubiHSM to send it data, preventing any further operations until the yubihsm-connector is restarted. An attacker can send 0, 1, or 2 bytes to trigger this.

References

github.com/Yubico/yubihsm-connector/commit/82bdf202c53460bac9106cc9b4b34a0a16cae0ed
github.com/Yubico/yubihsm-connector/releases
github.com/advisories/GHSA-8m9g-647g-5pxw
nvd.nist.gov/vuln/detail/CVE-2021-28484
www.yubico.com/support/security-advisories/ysa-2021-02/

Code Behaviors & Features

Detect and mitigate CVE-2021-28484 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →