Like Lightning From the Cloud: Finding RCEs in an Embedded TLS Library

Overview: Armis researchers Yuval and Gal present "TLStorm," a collection of critical vulnerabilities identified within the proprietary NanoSSL embedded TLS library (developed by Mocana, later acquired by DigiCert) and its implementation across enterprise hardware. The research demonstrates how improper error handling and state machine desynchronization in networking and power devices enable pre-authentication remote code execution. The speakers showcase exploitation across Aruba switches, Avaya network appliances, and Schneider Electric / APC Smart-UPS devices, demonstrating captive portal bypasses, lateral network movement, and physical equipment damage.

Key Topics: - Embedded software supply chain security and the dynamics of proprietary vs. open-source libraries (NanoSSL) - TLStorm: eight critical vulnerabilities impacting Aruba switches, Avaya networking, and APC Smart-UPS hardware - TLS packet reassembly state machine confusion and internal heap buffer overflow mechanics - Exploiting unauthenticated captive portal interfaces for root execution, VLAN hopping, and lateral movement - Attacking IoT cloud management architectures (APC SmartConnect) to induce physical hardware damage

Technical Details: The presentation examines systemic software supply chain risks in embedded hardware, where third-party libraries comprise roughly 70 percent of firmware codebases (mirroring the widespread impact of vulnerabilities like Log4Shell and Urgent/11). The researchers audited Mocana NanoSSL, a closed-source TLS stack widely deployed across enterprise systems. While proprietary libraries often rely on obscurity to deter attackers, the lack of public community auditing frequently conceals brittle integration interfaces where subtle vendor implementation mistakes lead to critical vulnerabilities.

The authors analyzed the NanoSSL packet reassembly engine. NanoSSL allocates a static 0x1000-byte internal buffer to hold incoming TCP streams. When processing fragmented TLS records, the library parses the record length header (e.g., 0x3000 bytes) and reallocates the buffer to fit the complete payload. However, if an attacker sends an oversized record length header (e.g., 0x5000 bytes) exceeding internal limits, the validation check fails and the parsing function aborts without expanding the internal buffer.

In vulnerable implementations across Aruba and Avaya switches, the calling loop failed to properly handle the receive API error code. Instead of terminating the TLS session upon failure, the loop continued executing, reading the subsequent incoming TCP packet while the parser remained in an active reassembly state. Because the initial buffer expansion was skipped, the incoming chunk was copied directly into the original 0x1000-byte buffer, triggering a controllable heap buffer overflow. In Aruba switches, the authors targeted this flaw against the unauthenticated captive portal interface, obtaining root code execution, bypassing network access controls, and pivoting across enterprise VLANs. In APC Smart-UPS systems (deployed across millions of enterprise networks), manipulating the cloud-connected SmartConnect TLS interface enabled attackers to alter power control logic and trigger physical hardware failure.

Key Takeaways: Integrating third-party embedded cryptographic libraries requires strict adherence to error-handling contracts; applications must unconditionally terminate network sessions upon encountering any TLS parsing error. Proprietary, closed-source firmware components do not provide inherent security and frequently suffer from integration oversights that community-audited libraries avoid. Critical infrastructure hardware, including enterprise switches and smart power distribution units, must never expose unauthenticated captive portals or management bridges to untrusted network segments.

(AI summary — Gemini Flash)