{"id":63087,"date":"2023-07-07T16:02:52","date_gmt":"2023-07-07T23:02:52","guid":{"rendered":"https:\/\/www.rambus.com\/?page_id=63087"},"modified":"2023-07-10T07:58:40","modified_gmt":"2023-07-10T14:58:40","slug":"rmbs-2023-03","status":"publish","type":"page","link":"https:\/\/www.rambus.com\/security\/response-center\/advisories\/rmbs-2023-03\/","title":{"rendered":"Remote denial of service vulnerability in MatrixSSL (TLS Toolkit)"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Home<\/a><\/span><\/span><\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Title<\/strong><\/td>Remote denial of service vulnerability
in MatrixSSL (TLS Toolkit)<\/td><\/tr>
Rambus Tracking ID<\/strong><\/td>RMBS-2023-03<\/td><\/tr>
CVE (if applicable)<\/strong><\/td>\u00a0<\/td><\/tr>
Publication Date
(YYYY-MM-DD)<\/strong><\/td>		2023-06-01<\/td><\/tr><\/tbody><\/table>

Background<\/strong><\/p>

A security vulnerability has been identified in the Rambus TLS Toolkit software and its open-source version, MatrixSSL (TLS Toolkit) (formerly from Inside Secure). A release which remediates the vulnerability is available and has been distributed to existing customers that are affected.\u00a0<\/strong><\/p>

Vulnerability Description<\/strong><\/p>

The vulnerability is located in the TLSv1.3 pre-shared-key extension parsing of the TLS-Client-Hello message. The function tls13VerifyBinder() executes the following function:<\/p>

\/\/prototype
int32_t tls13TranscriptHashUpdate(ssl_t *ssl,
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0const unsigned char *in,
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0psSize_t len)<\/p>

\/\/execution
tls13TranscriptHashUpdate(ssl,
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0ssl->sec.tls13CHStart,
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0ssl->sec.tls13CHLen – ssl->sec.tls13BindersLen);<\/p>

The input parameter of the execution contains the subtraction:
ssl->sec.tls13CHLen -ssl->sec.tls13BindersLen.
At this point, a short integer (psSize_t len) wrap around can happen, because the datatype psSize_t is unsigned short integer and there is no length check to avoid it. In worst case, the variable len gets the value 65535 and the attacked device will calculate a hash like SHA-2 over at least 65 kilobytes RAM data.<\/p>

Severity Level<\/strong>
This is considered a High severity bug.<\/p>

Impact<\/strong>
The vulnerability allows an attacker to execute a hash (e.g. SHA-2) over at least 65 kilobytes RAM<\/p>

data per TLS-Client-Hello message. With a large number of messages, the CPU is heavily loaded and can lead to a DoS attack.<\/p>

Affected Products<\/strong><\/p>
Product Name<\/strong><\/td>Version(s)<\/strong><\/td><\/tr><\/thead>
MatrixSSL (TLS Toolkit)<\/td>4.0.0, 4.0.1, 4.0.2, 4.1.0, 4.2.0, 4.2.1, 4.2.2, 4.3.0, 4.4.0, 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.6.0 (if TLS1.3 is enabled)<\/td><\/tr>
SafeZone FIPS140-2 Complete<\/td>

10.5.0, 10.5.1, 10.5.2, 10.5.3, 10.6.0<\/p>

if MatrixSSL is used and TLS1.3 is enabled<\/p><\/td><\/tr>

SafeZone FIPS140-3 Complete<\/td>

10.5.0, 10.5.1, 10.5.2, 10.5.3, 10.6.0<\/p>

if MatrixSSL is used and TLS1.3 is enabled<\/p><\/td><\/tr>

SafeZone FIPS SW Toolkit<\/td>10.3.0, 10.4.0
if MatrixSSL is used and TLS1.3 is enabled<\/td><\/tr>
Inside Secure FIPS SW Toolkit<\/td>

10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1 10.2.2<\/p>

if MatrixSSL is used and TLS1.3 is enabled<\/p><\/td><\/tr>

SafeZone FIPS SW Toolkit FIPS_140-3_rc3<\/td>10.4.x if MatrixSSL is used and TLS1.3 is enabled<\/td><\/tr>
TLS FIPS Toolkit<\/td>4.3.0, 4.4.0, 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.6.0 (if TLS1.3 is enabled)<\/td><\/tr><\/tbody><\/table>

\u00a0<\/strong><\/p>

Unaffected Products<\/strong><\/p>
Product Name<\/strong><\/td>Version(s)<\/strong><\/td><\/tr>
MatrixSSL (TLS Toolkit)<\/td>3.x and before<\/td><\/tr>
SafeZone FIPS SW Toolkit<\/td>9.x and before<\/td><\/tr><\/tbody><\/table>

\u00a0<\/strong><\/p>

Remediation<\/strong>
Rambus has developed patched versions of MatrixSSL (TLS Toolkit) that addresses the vulnerability. The fix checks if there would be a wraparound and, in that case, returns alert 50 (decode error).<\/p>

Action Taken<\/strong>
Rambus is planning an update that fixes security issues in the open source MatrixSSL version but as this is a high severity issue, we will pre-notify TLS Toolkit customers directly and provide a patch or new release before publishing the MatrixSSL update.<\/p>

An updated package \u2013 version 4.7.0 \u2013 will be released to GitHub on 2023-07-04. (https:\/\/github.com\/matrixssl\/matrixssl<\/a>)<\/p>

No further information about the issues will be provided.<\/p>

Acknowledgement<\/strong>
The vulnerability was found by Robert H\u00f6rr and Alissar Ibrahim, Security Evaluators of the Telekom Security Evaluation Facility.<\/p>

For any inquiries, please contact<\/a> Rambus.<\/p>

Revision History<\/strong><\/p>
Version<\/strong><\/td>Description<\/strong><\/td>Status<\/strong><\/td>Date (YYYY-MM-DD)<\/strong><\/td><\/tr>
1.2<\/td>Initial Public Release<\/td>Final<\/td>2023-06-01<\/td><\/tr><\/tbody><\/table>

\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Title Remote denial of service vulnerabilityin MatrixSSL (TLS Toolkit) Rambus Tracking ID RMBS-2023-03 CVE (if applicable) \u00a0 Publication Date(YYYY-MM-DD) 2023-06-01 Background A security vulnerability has been identified in the Rambus TLS Toolkit software and its open-source version, MatrixSSL (TLS Toolkit) (formerly from Inside Secure). A release which remediates the vulnerability is available and has been […]<\/p>\n","protected":false},"author":6,"featured_media":0,"parent":62164,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"template-full.php","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":"","_links_to":"","_links_to_target":""},"tags":[],"class_list":{"0":"post-63087","1":"page","2":"type-page","3":"status-publish","5":"entry"},"yoast_head":"\nRemote denial of service vulnerability in MatrixSSL (TLS Toolkit) - Rambus<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.rambus.com\/security\/response-center\/advisories\/rmbs-2023-03\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Remote denial of service vulnerability in MatrixSSL (TLS Toolkit)\" \/>\n<meta property=\"og:description\" content=\"TitleRemote denial of service vulnerabilityin MatrixSSL (TLS Toolkit)Rambus Tracking IDRMBS-2023-03CVE (if applicable)\u00a0Publication\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.rambus.com\/security\/response-center\/advisories\/rmbs-2023-03\/\" \/>\n<meta property=\"og:site_name\" content=\"Rambus\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/RambusInc\" \/>\n<meta property=\"article:modified_time\" content=\"2023-07-10T14:58:40+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@rambusinc\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.rambus.com\/security\/response-center\/advisories\/rmbs-2023-03\/\",\"url\":\"https:\/\/www.rambus.com\/security\/response-center\/advisories\/rmbs-2023-03\/\",\"name\":\"Remote denial of service vulnerability in MatrixSSL (TLS Toolkit) - Rambus\",\"isPartOf\":{\"@id\":\"https:\/\/www.rambus.com\/#website\"},\"datePublished\":\"2023-07-07T23:02:52+00:00\",\"dateModified\":\"2023-07-10T14:58:40+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.rambus.com\/security\/response-center\/advisories\/rmbs-2023-03\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.rambus.com\/security\/response-center\/advisories\/rmbs-2023-03\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.rambus.com\/security\/response-center\/advisories\/rmbs-2023-03\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.rambus.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security IP\",\"item\":\"https:\/\/www.rambus.com\/security\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Security Response Center\",\"item\":\"https:\/\/www.rambus.com\/security\/response-center\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Security Advisories\",\"item\":\"https:\/\/www.rambus.com\/security\/response-center\/advisories\/\"},{\"@type\":\"ListItem\",\"position\":5,\"name\":\"Remote denial of service vulnerability in MatrixSSL (TLS Toolkit)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.rambus.com\/#website\",\"url\":\"https:\/\/www.rambus.com\/\",\"name\":\"Rambus\",\"description\":\"At Rambus, we create cutting-edge semiconductor and IP products, providing industry-leading chips and silicon IP to make data faster and safer.\",\"publisher\":{\"@id\":\"https:\/\/www.rambus.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.rambus.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.rambus.com\/#organization\",\"name\":\"Rambus\",\"url\":\"https:\/\/www.rambus.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.rambus.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.rambus.com\/wp-content\/uploads\/2025\/09\/Rambus_Logo.png\",\"contentUrl\":\"https:\/\/www.rambus.com\/wp-content\/uploads\/2025\/09\/Rambus_Logo.png\",\"width\":200,\"height\":62,\"caption\":\"Rambus\"},\"image\":{\"@id\":\"https:\/\/www.rambus.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/RambusInc\",\"https:\/\/x.com\/rambusinc\",\"https:\/\/www.linkedin.com\/company\/rambus\",\"https:\/\/www.youtube.com\/user\/RambusWeb\"],\"description\":\"Rambus is a provider of industry-leading chips and silicon IP.\",\"email\":\"ebiz@rambus.com\",\"telephone\":\"+1-408-462-8000\",\"legalName\":\"Rambus Inc.\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"minValue\":\"501\",\"maxValue\":\"1000\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Remote denial of service vulnerability in MatrixSSL (TLS Toolkit) - Rambus","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.rambus.com\/security\/response-center\/advisories\/rmbs-2023-03\/","og_locale":"en_US","og_type":"article","og_title":"Remote denial of service vulnerability in MatrixSSL (TLS Toolkit)","og_description":"TitleRemote denial of service vulnerabilityin MatrixSSL (TLS Toolkit)Rambus Tracking IDRMBS-2023-03CVE (if applicable)\u00a0Publication","og_url":"https:\/\/www.rambus.com\/security\/response-center\/advisories\/rmbs-2023-03\/","og_site_name":"Rambus","article_publisher":"https:\/\/www.facebook.com\/RambusInc","article_modified_time":"2023-07-10T14:58:40+00:00","twitter_card":"summary_large_image","twitter_site":"@rambusinc","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.rambus.com\/security\/response-center\/advisories\/rmbs-2023-03\/","url":"https:\/\/www.rambus.com\/security\/response-center\/advisories\/rmbs-2023-03\/","name":"Remote denial of service vulnerability in MatrixSSL (TLS Toolkit) - Rambus","isPartOf":{"@id":"https:\/\/www.rambus.com\/#website"},"datePublished":"2023-07-07T23:02:52+00:00","dateModified":"2023-07-10T14:58:40+00:00","breadcrumb":{"@id":"https:\/\/www.rambus.com\/security\/response-center\/advisories\/rmbs-2023-03\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.rambus.com\/security\/response-center\/advisories\/rmbs-2023-03\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.rambus.com\/security\/response-center\/advisories\/rmbs-2023-03\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.rambus.com\/"},{"@type":"ListItem","position":2,"name":"Security IP","item":"https:\/\/www.rambus.com\/security\/"},{"@type":"ListItem","position":3,"name":"Security Response Center","item":"https:\/\/www.rambus.com\/security\/response-center\/"},{"@type":"ListItem","position":4,"name":"Security Advisories","item":"https:\/\/www.rambus.com\/security\/response-center\/advisories\/"},{"@type":"ListItem","position":5,"name":"Remote denial of service vulnerability in MatrixSSL (TLS Toolkit)"}]},{"@type":"WebSite","@id":"https:\/\/www.rambus.com\/#website","url":"https:\/\/www.rambus.com\/","name":"Rambus","description":"At Rambus, we create cutting-edge semiconductor and IP products, providing industry-leading chips and silicon IP to make data faster and safer.","publisher":{"@id":"https:\/\/www.rambus.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.rambus.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.rambus.com\/#organization","name":"Rambus","url":"https:\/\/www.rambus.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.rambus.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.rambus.com\/wp-content\/uploads\/2025\/09\/Rambus_Logo.png","contentUrl":"https:\/\/www.rambus.com\/wp-content\/uploads\/2025\/09\/Rambus_Logo.png","width":200,"height":62,"caption":"Rambus"},"image":{"@id":"https:\/\/www.rambus.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/RambusInc","https:\/\/x.com\/rambusinc","https:\/\/www.linkedin.com\/company\/rambus","https:\/\/www.youtube.com\/user\/RambusWeb"],"description":"Rambus is a provider of industry-leading chips and silicon IP.","email":"ebiz@rambus.com","telephone":"+1-408-462-8000","legalName":"Rambus Inc.","numberOfEmployees":{"@type":"QuantitativeValue","minValue":"501","maxValue":"1000"}}]}},"_links":{"self":[{"href":"https:\/\/www.rambus.com\/wp-json\/wp\/v2\/pages\/63087","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rambus.com\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.rambus.com\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.rambus.com\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rambus.com\/wp-json\/wp\/v2\/comments?post=63087"}],"version-history":[{"count":0,"href":"https:\/\/www.rambus.com\/wp-json\/wp\/v2\/pages\/63087\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/www.rambus.com\/wp-json\/wp\/v2\/pages\/62164"}],"wp:attachment":[{"href":"https:\/\/www.rambus.com\/wp-json\/wp\/v2\/media?parent=63087"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rambus.com\/wp-json\/wp\/v2\/tags?post=63087"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}