CVE-2024-29857: Bouncy Castle DoS Vulnerability

CVE-2024-29857 Overview

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

Critical Impact

This vulnerability allows remote attackers to cause a Denial of Service condition by providing maliciously crafted elliptic curve certificates with specially crafted F2m (binary field) parameters, resulting in excessive CPU consumption that can render applications unresponsive.

Affected Products

• Bouncy Castle Java (BC Java) before version 1.78
• Bouncy Castle Java LTS before version 2.73.6
• Bouncy Castle FIPS Java API (BC-FJA) before version 1.0.2.5
• Bouncy Castle C# .Net before version 2.3.1

Discovery Timeline

• 2024-05-14 - CVE-2024-29857 published to NVD
• 2024-12-06 - Last updated in NVD database

Technical Details for CVE-2024-29857

Vulnerability Analysis

This vulnerability exists in the elliptic curve cryptography implementation within Bouncy Castle's ECCurve.java (Java) and ECCurve.cs (C#) components. The flaw occurs when processing EC certificates that contain specially crafted F2m (binary field) curve parameters. When such malicious certificates are imported and parsed, the curve parameter evaluation algorithm enters a computationally expensive loop, consuming excessive CPU resources.

The vulnerability is classified under CWE-125 (Out-of-bounds Read), indicating that improper bounds checking during the processing of curve parameters contributes to the resource exhaustion condition. The attack can be executed remotely over the network without requiring any authentication or user interaction, making it particularly dangerous for applications that process untrusted certificates.

Root Cause

The root cause of this vulnerability lies in insufficient validation of F2m curve parameters during EC certificate import operations. The ECCurve class implementations fail to properly validate the computational complexity of the supplied curve parameters before attempting to evaluate them. When an attacker supplies carefully crafted F2m parameters, the evaluation algorithm performs an excessive number of calculations, leading to CPU exhaustion.

Specifically, the curve parameter parsing routines do not impose adequate limits on the mathematical operations required to process the curve definition, allowing malicious inputs to trigger algorithmic complexity attacks.

Attack Vector

The attack vector is network-based, requiring no privileges or user interaction. An attacker can exploit this vulnerability by:

1. Crafting a malicious EC certificate with specially designed F2m curve parameters
2. Submitting this certificate to any application using a vulnerable version of Bouncy Castle
3. The certificate parsing triggers excessive CPU consumption during curve parameter evaluation
4. The target application becomes unresponsive, resulting in denial of service

The vulnerability manifests in the elliptic curve parameter validation routines. When processing F2m (binary field) curve definitions, the implementation performs curve parameter evaluation without adequate complexity bounds. Malicious certificates can specify parameters that require exponentially more computation than legitimate curves, causing CPU exhaustion during the import process. See the GitHub Java Security Advisory and GitHub C# Security Advisory for detailed technical information.

Detection Methods for CVE-2024-29857

Indicators of Compromise

• Unusual CPU spikes in applications processing EC certificates or cryptographic operations
• Application hangs or timeouts during certificate import or validation operations
• Increased processing time for TLS handshakes or certificate chain validation
• Service unavailability correlated with certificate processing requests

Detection Strategies

• Monitor for abnormal CPU utilization patterns in applications using Bouncy Castle cryptographic libraries
• Implement logging and alerting for certificate processing operations that exceed normal duration thresholds
• Deploy application performance monitoring to detect resource exhaustion attacks
• Analyze incoming certificates for unusual or non-standard elliptic curve parameters before processing

Monitoring Recommendations

• Enable detailed logging for certificate import operations in applications using Bouncy Castle
• Set up CPU utilization alerts with baselines for normal cryptographic operation workloads
• Monitor application response times and set thresholds for certificate validation operations
• Implement circuit breakers or timeouts for certificate processing to prevent cascading failures

How to Mitigate CVE-2024-29857

Immediate Actions Required

• Upgrade Bouncy Castle Java to version 1.78 or later immediately
• Upgrade Bouncy Castle Java LTS to version 2.73.6 or later
• Upgrade Bouncy Castle FIPS Java API (BC-FJA) to version 1.0.2.5 or later
• Upgrade Bouncy Castle C# .Net to version 2.3.1 or later
• Audit all applications in your environment that utilize Bouncy Castle libraries

Patch Information

Security patches are available from the Bouncy Castle project. The fixed versions include proper validation of F2m curve parameters to prevent the CPU exhaustion condition:

• BC Java: Version 1.78+ - Bouncy Castle Latest Releases
• BC Java LTS: Version 2.73.6+
• BC-FJA: Version 1.0.2.5+
• BC C# .Net: Version 2.3.1+

For additional vendor-specific guidance, refer to the NetApp Security Advisory NTAP-20241206-0008.

Workarounds

• Implement certificate validation timeouts at the application level to prevent extended processing
• Add input validation to reject EC certificates with unusual or non-standard curve parameters before passing to Bouncy Castle
• Deploy rate limiting for certificate submission endpoints to reduce the impact of exploitation attempts
• Consider using certificate allowlists in high-security environments to only accept certificates from known issuers

# Maven dependency update example for BC Java
# Update pom.xml to use patched version:
# <dependency>
#     <groupId>org.bouncycastle</groupId>
#     <artifactId>bcprov-jdk18on</artifactId>
#     <version>1.78</version>
# </dependency>

# Gradle dependency update example:
# implementation 'org.bouncycastle:bcprov-jdk18on:1.78'

# Verify installed Bouncy Castle version in Java applications:
java -cp your-application.jar org.bouncycastle.LICENSE