IM
IronMonkey Threat Research

CVE-2022-0778 HIGH

Published: 2022-03-15 | Last Modified: 2026-05-22 | Status: Modified

Description

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).

Additional Descriptions (1)

La función BN_mod_sqrt(), que calcula una raíz cuadrada modular, contiene un error que puede causar un bucle eterno para módulos no primos. Internamente, esta función es usado cuando son analizados certificados que contienen claves públicas de curva elíptica en forma comprimida o parámetros de curva elíptica explícitos con un punto base codificado en forma comprimida. Es posible desencadenar el bucle infinito si es diseñado un certificado con parámetros de curva explícitos no válidos. Dado que el análisis del certificado es realizado antes de la verificación de la firma del certificado, cualquier proceso que analice un certificado suministrado externamente puede ser objeto de un ataque de denegación de servicio. El bucle infinito también puede alcanzarse cuando son analizadas claves privadas diseñadas, ya que pueden contener parámetros explícitos de la curva elíptica. Por lo tanto, las situaciones vulnerables incluyen: - Clientes TLS que consumen certificados de servidor - Servidores TLS que consumen certificados de cliente - Proveedores de hosting que toman certificados o claves privadas de clientes - Autoridades de certificación que analizan peticiones de certificación de suscriptores - Cualquier otra cosa que analice parámetros de curva elíptica ASN.1 También cualquier otra aplicación que utilice BN_mod_sqrt() donde el atacante pueda controlar los valores de los parámetros es vulnerable a este problema de DoS. En OpenSSL versión 1.0.2, la clave pública no es analizada durante el análisis inicial del certificado, lo que dificulta ligeramente la activación del bucle infinito. Sin embargo, cualquier operación que requiera la clave pública del certificado desencadenará el bucle infinito. En particular, el atacante puede usar un certificado autofirmado para desencadenar el bucle durante la verificación de la firma del certificado. Este problema afecta a OpenSSL versiones 1.0.2, 1.1.1 y 3.0. Fue abordado en las versiones 1.1.1n y 3.0.2 del 15 de marzo de 2022. Corregido en OpenSSL versión 3.0.2 (Afectado 3.0.0,3.0.1). Corregido en OpenSSL versión 1.1.1n (Afectado 1.1.1-1.1.1m). Corregido en OpenSSL versión 1.0.2zd (Afectado 1.0.2-1.0.2zc)

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-835
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-835

Affected Products

Vendor Product Version Update Type
openssl openssl * <built-in method update of dict object at 0x7fd384a84280> Application
openssl openssl * <built-in method update of dict object at 0x7fd36bd2b140> Application
openssl openssl * <built-in method update of dict object at 0x7fd36a0da9c0> Application
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd39c1acb80> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd36a0dac00> Operating System
debian debian_linux 11.0 <built-in method update of dict object at 0x7fd36a0d9000> Operating System
netapp cloud_volumes_ontap_mediator - <built-in method update of dict object at 0x7fd36a0dae80> Application
netapp clustered_data_ontap - <built-in method update of dict object at 0x7fd39c4b7100> Application
netapp clustered_data_ontap_antivirus_connector - <built-in method update of dict object at 0x7fd36a0d90c0> Application
netapp santricity_smi-s_provider - <built-in method update of dict object at 0x7fd36a0d96c0> Application
netapp storagegrid - <built-in method update of dict object at 0x7fd36a0db9c0> Application
netapp a250_firmware - <built-in method update of dict object at 0x7fd39c1af180> Operating System
netapp 500f_firmware - <built-in method update of dict object at 0x7fd36a0da540> Operating System
fedoraproject fedora 34 <built-in method update of dict object at 0x7fd36bd2ab80> Operating System
fedoraproject fedora 36 <built-in method update of dict object at 0x7fd39c1acbc0> Operating System
tenable nessus * <built-in method update of dict object at 0x7fd39c4b7700> Application
tenable nessus * <built-in method update of dict object at 0x7fd39c1ace80> Application
mariadb mariadb * <built-in method update of dict object at 0x7fd36a0dad40> Application
mariadb mariadb * <built-in method update of dict object at 0x7fd39c4b4180> Application
mariadb mariadb * <built-in method update of dict object at 0x7fd39c1ae000> Application
mariadb mariadb * <built-in method update of dict object at 0x7fd36a0db400> Application
mariadb mariadb * <built-in method update of dict object at 0x7fd36a0dae40> Application
mariadb mariadb * <built-in method update of dict object at 0x7fd36a0d9980> Application
nodejs node.js * <built-in method update of dict object at 0x7fd39c1ada40> Application
nodejs node.js * <built-in method update of dict object at 0x7fd36a0dbf00> Application
nodejs node.js * <built-in method update of dict object at 0x7fd38449b400> Application
nodejs node.js * <built-in method update of dict object at 0x7fd39c4b5640> Application
nodejs node.js * <built-in method update of dict object at 0x7fd36a0d86c0> Application
nodejs node.js * <built-in method update of dict object at 0x7fd36bd29f80> Application
nodejs node.js * <built-in method update of dict object at 0x7fd39c1aec80> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:cloud_volumes_ontap_mediator:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:500f_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:500f:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Yes cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
Yes cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Yes cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
Yes cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Yes cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
Yes cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

References