Unauthenticated DTLS 1.2 Association Teardown in OpenSSL via Malformed AEAD Record
AI analysis
OpenSSL's record layer passes a record's length to the AEAD cipher implementation before verifying it can contain the mandatory explicit IV plus authentication tag, so an undersized encrypted fragment gets treated as an internal failure and raises a fatal internal_error alert. In DTLS 1.2, a single unauthenticated UDP datagram shorter than that overhead, routed to an existing association using an AEAD cipher suite, tears the association down with no key material required — a denial of service limited to that one association, with no memory-safety or confidentiality impact. In TLS 1.2 the same input merely produces the wrong alert (internal_error instead of bad_record_mac) and is a protocol conformance issue rather than a security flaw. Affected deployments are OpenSSL-based services terminating DTLS 1.2 with AEAD cipher suites — typical of VPN gateways, IoT/CoAP, and SIP-over-DTLS — and the affected code sits outside the FIPS module boundary. There is no public PoC and no known exploitation; note that the related headline about a heap-memory-disclosure DTLS flaw refers to a different OpenSSL issue, not this CVE.
What to do: Upgrade to the fixed OpenSSL release named in the OpenSSL security advisory (or your OS/distribution or appliance vendor's patched package), where record length is validated against the explicit IV and tag before AEAD processing so DTLS silently discards malformed records. Prioritize anything terminating DTLS 1.2 with AEAD ciphers on untrusted networks — VPN gateways, CoAP/IoT services, and SIP-over-DTLS. Where patching is delayed, restrict UDP access to DTLS ports to known peers where feasible; the impact is limited to single-association teardown, so risk is moderate but the patch is low-cost.
Affected
| OpenSSL (TLS/DTLS 1.2 record layer, AEAD cipher suite handling) | Specific version ranges not stated in the provided data; flaw affects DTLS 1.2 associations using AEAD cipher suites — consult the OpenSSL security advisory for |
Description
Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key material. This is a Denial of Service limited to the targeted association. There is no memory safety or confidentiality impact. CWE: CWE-1284: Improper Validation of Specified Quantity in Input Description: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and an authentication tag. When decrypting such a record the record layer passed the record length to the cipher implementation before checking that the record was long enough to contain the explicit IV and the tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and the record layer treated this as an internal failure and raised a fatal internal_error alert instead of treating the record as one that failed authentication. In TLS 1.2 the same record causes a fatal internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS. The fix validates the record length against the explicit IV and tag length before any AEAD processing, so that TLS reports bad_record_mac and DTLS silently discards the record. FIPS impact: no The affected code is outside the FIPS module boundary.