CVE-2024-30172: Bouncy Castle Ed25519 DoS Vulnerability

CVE-2024-30172 Overview

CVE-2024-30172 is a denial of service vulnerability discovered in the Bouncy Castle Java Cryptography APIs. The vulnerability exists in the Ed25519 signature verification code, where a crafted signature and public key combination can trigger an infinite loop condition, causing the application to hang indefinitely. This algorithmic complexity attack can be exploited remotely without authentication to exhaust system resources and deny service to legitimate users.

Critical Impact

Remote attackers can cause a complete denial of service by submitting maliciously crafted Ed25519 signatures, potentially rendering cryptographic operations and dependent applications unresponsive.

Affected Products

• Bouncy Castle Java Cryptography APIs versions prior to 1.78
• Applications and services utilizing Bouncy Castle for Ed25519 signature verification
• Enterprise systems with dependencies on vulnerable Bouncy Castle libraries

Discovery Timeline

• 2024-05-14 - CVE-2024-30172 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-30172

Vulnerability Analysis

The vulnerability resides in the Ed25519 signature verification implementation within Bouncy Castle's Java Cryptography APIs. Ed25519 is a widely-used elliptic curve digital signature algorithm based on Curve25519, commonly employed for authentication in protocols like SSH, TLS, and various blockchain implementations.

The flaw manifests when the verification function processes specifically crafted input parameters. Under normal operation, the verification algorithm performs a bounded number of cryptographic operations. However, malformed signature and public key combinations can cause the internal verification logic to enter a non-terminating loop state.

This vulnerability allows network-accessible attackers to exploit the flaw without requiring authentication or user interaction. The impact is limited to availability—there is no compromise of data confidentiality or integrity. However, the denial of service can be severe, potentially affecting all cryptographic operations that depend on the vulnerable library.

Root Cause

The root cause is an insufficient bounds check or exit condition in the Ed25519 verification algorithm implementation. When processing certain edge-case inputs involving malformed cryptographic parameters, the algorithm fails to properly terminate, resulting in an infinite loop that consumes CPU resources indefinitely. This represents an algorithmic complexity vulnerability where the computational cost of verification becomes unbounded for specific malicious inputs.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker can exploit this vulnerability by:

1. Identifying an application or service that uses Bouncy Castle for Ed25519 signature verification
2. Crafting a malicious signature and public key pair designed to trigger the infinite loop condition
3. Submitting the crafted cryptographic parameters to the target system
4. The vulnerable verification code enters an infinite loop, consuming CPU resources and blocking the processing thread

The attack is particularly effective against services that perform signature verification on untrusted input, such as authentication endpoints, certificate validation services, or blockchain nodes processing transactions. Multiple concurrent requests with malicious inputs can amplify the denial of service effect.

Detection Methods for CVE-2024-30172

Indicators of Compromise

• Unusually high CPU utilization by Java processes performing cryptographic operations
• Application threads stuck in Bouncy Castle Ed25519 verification methods
• Service timeouts or unresponsiveness in components using Ed25519 signatures
• Thread dumps showing infinite loops in org.bouncycastle.math.ec or related packages

Detection Strategies

• Implement Software Composition Analysis (SCA) to identify Bouncy Castle library versions in your codebase
• Monitor Java application thread states for prolonged execution in cryptographic verification functions
• Set up alerting on CPU consumption anomalies for services performing signature verification
• Conduct dependency audits to identify all applications consuming Bouncy Castle libraries

Monitoring Recommendations

• Configure application performance monitoring (APM) to track Ed25519 verification operation duration
• Implement timeout mechanisms around cryptographic verification calls
• Monitor for repeated failed signature verification attempts from the same source
• Review application logs for cryptographic operation exceptions or hangs

How to Mitigate CVE-2024-30172

Immediate Actions Required

• Update Bouncy Castle Java Cryptography APIs to version 1.78 or later immediately
• Identify all applications and services that depend on Bouncy Castle through dependency scanning
• Prioritize patching for internet-facing services that process Ed25519 signatures
• Consider implementing request rate limiting on endpoints that perform signature verification

Patch Information

The vulnerability has been addressed in Bouncy Castle version 1.78. The fix corrects the boundary conditions in the Ed25519 verification algorithm to ensure proper termination regardless of input parameters. Organizations should update to the patched version by modifying their Maven, Gradle, or other build configuration dependencies.

For detailed information about the fix and release notes, refer to the Bouncy Castle Release Notes. Additional vendor guidance is available in the NetApp Security Advisory NTAP-20240614-0007.

Workarounds

• Implement timeout wrappers around Ed25519 verification operations to prevent indefinite hangs
• Add input validation to reject obviously malformed signatures before passing to the verification function
• Deploy Web Application Firewalls (WAF) to rate-limit or filter suspicious cryptographic requests
• Consider using application-level circuit breakers to isolate failures in cryptographic operations

# Maven dependency update example
# Update pom.xml to use patched Bouncy Castle version
# Replace existing bcprov-jdk15on dependency with:
# <dependency>
#     <groupId>org.bouncycastle</groupId>
#     <artifactId>bcprov-jdk18on</artifactId>
#     <version>1.78</version>
# </dependency>

# Gradle dependency update
# implementation 'org.bouncycastle:bcprov-jdk18on:1.78'

# Verify installed version after update
mvn dependency:tree | grep bouncycastle