2026089 - (CVE-2026-6772) Heap Buffer Overflow in NSS TLS Extension Handling

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Sandeep Seehra [:sandeep]]

Attachment: findings.zip

Hi,

We're writing from Trail of Bits, a security research firm. We found
a security issue in NSS and have prepared a patch. The finding is
rated Medium. Details are below.

FINDINGS

NSS records negotiated TLS extensions by appending extension ids into
sslSocket.xtnData.negotiated[] (a fixed-size array) using
xtnData->negotiated[xtnData->numNegotiated++] in multiple extension
handlers. These writes have no bounds check and do not de-duplicate
entries. A TLS peer that drives a handshake into recording more than
SSL_MAX_EXTENSIONS negotiated extensions triggers a heap buffer
overflow write (2 bytes per appended extension id).

The provided PoC demonstrates this in TLS 1.3 while processing a server
CertificateRequest that negotiates certificate compression. This occurs
pre-authentication during the TLS handshake; the PoC path requires
certificate compression to be enabled by the application.

REPRODUCTION

Build fuzzers:
python3 infra/helper.py build_fuzzers --clean --sanitizer address nss /path/to/nss

Run the PoC:
python3 infra/helper.py reproduce nss tls-client-no_fuzzer_mode poc.bin

Apply the patch and rebuild:
patch -p1 < patch.diff
python3 infra/helper.py build_fuzzers --clean --sanitizer address nss /path/to/nss
python3 infra/helper.py reproduce nss tls-client-no_fuzzer_mode poc.bin

ATTACHMENTS

We have attached a zip containing:

• Full technical details of each finding
• Reproduction steps and proof-of-concept where applicable
• Candidate patch(es) with regression tests

BACKGROUND

Anthropic is conducting research into the use of large language models
for automated vulnerability discovery in open source software. As part
of that work, Anthropic used Claude to scan a set of widely used open
source projects for security issues. Anthropic then engaged Trail of
Bits to independently triage, manually validate, and develop patches
for the findings. Each issue in this report has been reviewed and
confirmed by human security researchers at Trail of Bits.

NEXT STEPS

We are disclosing under Anthropic's coordinated vulnerability
disclosure policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

Our disclosure timeline is 90 days from the date of
this email, with a 14-day extension available if needed.

We'd like to work with your maintainers to get these issues fixed. We
are happy to submit PRs or coordinate with your preferred process. Let
us know if there's a specific security contact you'd like us to work
with.

Thanks for your work on NSS.

— Trail of Bits, in collaboration with Anthropic

Comment 1

[Dennis Jackson]

I'm unable to reproduce with the example PoC. Can you confirm that the described issue reproduces reliably for you?

Similarly, much of the report looks plausible, but doesn't provide enough information to reconstruct how the bug is triggered.

Comment 2

[Dennis Jackson]

Ok, I was able to rediscover the issue by crafting some different hypotheses and asking Claude to write a test case. The problem is that when PostHandshakeAuth is enabled, each new CertificateRequest with an extension increments the counter, eventually leading to a heap buffer overflow.

Thankfully, this is off by default in Firefox and can only be enabled via the pref security.tls.enable_post_handshake_auth. In NSS it's also off by default, but can be enabled via the option SSL_ENABLE_POST_HANDSHAKE_AUTH.

Comment 3

[Dennis Jackson]

Attachment: (secure)

Comment 4

[Dennis Jackson]

Attachment: (secure)

Comment 5

[Dennis Jackson]

These patches are going to need a little more work, but demonstrate the issue via some new tests and fix it.

Comment 6

[Daniel Veditz [:dveditz]]

Dennis: what does the oss-fuzz keyword mean here? This wasn't found by it

Comment 10

[Dennis Jackson]

I'm going to mark this sec-moderate;

• It clobbers memory, although not in a very controllable way
• It does so in the parent process in Firefox
• It's not enabled unless users have flipped an obscure pref in about:config
• Some external sites do advise users flip the pref, but we don't expose it via enterprise policy.

This report did not correctly identify the issue, the root cause or how to reproduce it. The report in bug 2026946 did correctly identify how to trigger the issue but not why or how. The reports in bug 2027326 and bug 2027370 are high quality and describe the issue in full.

Comment 11

[Phabricator Automation]

Comment on attachment 9557923 [details]
(secure)

Revision D289765 was moved to bug 2031343. Setting attachment 9557923 [details] to obsolete.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/5ccfed7b6219
Clarify extension negotiation mechanism for TLS Handshakes r=#nss-reviewers

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/961f1a40f5e7
Clarify extension negotiation mechanism for TLS Handshakes r=#nss-reviewers

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/49daef8233e9
Clarify extension negotiation mechanism for TLS Handshakes r=#nss-reviewers

Comment 15

[John Schanck [:jschanck]]

Attachment: (secure)

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/16b078cfa675
Clarify extension negotiation mechanism for TLS Handshakes (NSS 3.90.5). r=#nss-reviewers

Comment 17

[BugBot [:suhaib / :marco]]

A patch has been attached on this bug, which was already closed. Filing a separate bug will ensure better tracking. If this was not by mistake and further action is needed, please alert the appropriate party. (Or: if the patch doesn't change behavior -- e.g. landing a test case, or fixing a typo -- then feel free to disregard this message)