Summary: A recent white-box penetration test by X41 D-Sec GmbH on the Mullvad VPN application has uncovered several vulnerabilities, including one critical and two high-severity issues. Despite these findings, Mullvad VPN’s overall security posture remains strong, with prompt actions taken to address the vulnerabilities.
Threat Actor: Unknown | Unknown
Victim: Mullvad VPN AB | Mullvad VPN AB
Key Point :
- Three high-severity vulnerabilities were identified, including MLLVD-CR-24-01 (CVE-2024-55884, CVSS 9.0).
- The critical vulnerability relates to insufficient alternate stack sizes for signal handlers, posing a risk of memory corruption.
- Mullvad VPN has a strong commitment to security, employing safe coding practices and regular audits.
- X41 D-Sec GmbH recommends ongoing security reviews to enhance the system’s defenses.
X41 D-Sec GmbH, a leading cybersecurity firm, has completed a white-box penetration test of the Mullvad VPN application, revealing several vulnerabilities, including one rated as “critical” and two rated as “high” severity.
The audit uncovered three high-severity vulnerabilities, including issues with signal handlers and sideloading risks during installation processes. One notable vulnerability, MLLVD-CR-24-01 (CVE-2024-55884, CVSS 9.0), involves insufficient alternate stack sizes for signal handlers, potentially leading to memory corruption. As the report explains, “While exploitation for code execution is expected to be non-trivial, the fact that the alt stack collides with the heap of concurrently running processes makes exploitation a possibility if an attacker is able to trigger a signal in the right context.”
Despite these findings, X41 D-Sec GmbH acknowledged the high-security level of the Mullvad VPN application, stating that “Overall, the Mullvad VPN Application appear to have a high-security level and are well positioned to protect from the threat model proposed in this report.” The report also highlighted Mullvad’s commitment to security, noting their “use of safe coding and design patterns in combination with regular audits and penetration tests” which has “led to a very hardened environment.”
Mullvad VPN AB has responded swiftly to the findings, addressing the vulnerabilities and undergoing a fix audit to ensure effectiveness. X41 D-Sec GmbH recommends continued regular security reviews and mitigation of the identified issues, stating that doing so “will strengthen the security of the system and is recommended for defense in depth.”
Related Posts:
Source: https://securityonline.info/cve-2024-55884-cvss-9-0-critical-vulnerability-found-in-mullvad-vpn