IM
IronMonkey Threat Research

CVE-2022-0778 HIGH

Published: 2022-03-15 | Last Modified: 2026-05-22 | Status: Modified

Description

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).

Additional Descriptions (1)

La función BN_mod_sqrt(), que calcula una raíz cuadrada modular, contiene un error que puede causar un bucle eterno para módulos no primos. Internamente, esta función es usado cuando son analizados certificados que contienen claves públicas de curva elíptica en forma comprimida o parámetros de curva elíptica explícitos con un punto base codificado en forma comprimida. Es posible desencadenar el bucle infinito si es diseñado un certificado con parámetros de curva explícitos no válidos. Dado que el análisis del certificado es realizado antes de la verificación de la firma del certificado, cualquier proceso que analice un certificado suministrado externamente puede ser objeto de un ataque de denegación de servicio. El bucle infinito también puede alcanzarse cuando son analizadas claves privadas diseñadas, ya que pueden contener parámetros explícitos de la curva elíptica. Por lo tanto, las situaciones vulnerables incluyen: - Clientes TLS que consumen certificados de servidor - Servidores TLS que consumen certificados de cliente - Proveedores de hosting que toman certificados o claves privadas de clientes - Autoridades de certificación que analizan peticiones de certificación de suscriptores - Cualquier otra cosa que analice parámetros de curva elíptica ASN.1 También cualquier otra aplicación que utilice BN_mod_sqrt() donde el atacante pueda controlar los valores de los parámetros es vulnerable a este problema de DoS. En OpenSSL versión 1.0.2, la clave pública no es analizada durante el análisis inicial del certificado, lo que dificulta ligeramente la activación del bucle infinito. Sin embargo, cualquier operación que requiera la clave pública del certificado desencadenará el bucle infinito. En particular, el atacante puede usar un certificado autofirmado para desencadenar el bucle durante la verificación de la firma del certificado. Este problema afecta a OpenSSL versiones 1.0.2, 1.1.1 y 3.0. Fue abordado en las versiones 1.1.1n y 3.0.2 del 15 de marzo de 2022. Corregido en OpenSSL versión 3.0.2 (Afectado 3.0.0,3.0.1). Corregido en OpenSSL versión 1.1.1n (Afectado 1.1.1-1.1.1m). Corregido en OpenSSL versión 1.0.2zd (Afectado 1.0.2-1.0.2zc)

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-835
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-835

Affected Products

Vendor Product Version Update Type
openssl openssl * <built-in method update of dict object at 0x72a9b0b689c0> Application
openssl openssl * <built-in method update of dict object at 0x72a9cc427680> Application
openssl openssl * <built-in method update of dict object at 0x72a9cc427a40> Application
debian debian_linux 9.0 <built-in method update of dict object at 0x72a9b0b6ba00> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x72a9b0b6bd80> Operating System
debian debian_linux 11.0 <built-in method update of dict object at 0x72a9b0b6a6c0> Operating System
netapp cloud_volumes_ontap_mediator - <built-in method update of dict object at 0x72a9ccf9ed80> Application
netapp clustered_data_ontap - <built-in method update of dict object at 0x72a9cc4278c0> Application
netapp clustered_data_ontap_antivirus_connector - <built-in method update of dict object at 0x72a9ccf9f600> Application
netapp santricity_smi-s_provider - <built-in method update of dict object at 0x72a9b0b69e40> Application
netapp storagegrid - <built-in method update of dict object at 0x72a9cd06ee00> Application
netapp a250_firmware - <built-in method update of dict object at 0x72a9cd06cc80> Operating System
netapp 500f_firmware - <built-in method update of dict object at 0x72a9cd06e340> Operating System
fedoraproject fedora 34 <built-in method update of dict object at 0x72a9b0a75580> Operating System
fedoraproject fedora 36 <built-in method update of dict object at 0x72a9cc427140> Operating System
tenable nessus * <built-in method update of dict object at 0x72a9b0a771c0> Application
tenable nessus * <built-in method update of dict object at 0x72a9cc424f80> Application
mariadb mariadb * <built-in method update of dict object at 0x72a9b0b6ae40> Application
mariadb mariadb * <built-in method update of dict object at 0x72a9cc425900> Application
mariadb mariadb * <built-in method update of dict object at 0x72a9b0b6b0c0> Application
mariadb mariadb * <built-in method update of dict object at 0x72a9b0a74f80> Application
mariadb mariadb * <built-in method update of dict object at 0x72a9cc4247c0> Application
mariadb mariadb * <built-in method update of dict object at 0x72a9cd084a80> Application
nodejs node.js * <built-in method update of dict object at 0x72a9b0a77300> Application
nodejs node.js * <built-in method update of dict object at 0x72a9cd06d340> Application
nodejs node.js * <built-in method update of dict object at 0x72a9b0a763c0> Application
nodejs node.js * <built-in method update of dict object at 0x72a9ccf9e600> Application
nodejs node.js * <built-in method update of dict object at 0x72a9cd06eb00> Application
nodejs node.js * <built-in method update of dict object at 0x72a9cc4271c0> Application
nodejs node.js * <built-in method update of dict object at 0x72a9cc427b40> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:cloud_volumes_ontap_mediator:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:500f_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:500f:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Yes cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
Yes cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Yes cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
Yes cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Yes cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
Yes cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

References

Notification
Message here