IM
IronMonkey Threat Research

CVE-2022-1473 HIGH

Published: 2022-05-03 | Last Modified: 2025-05-05 | Status: Modified

Description

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

Additional Descriptions (1)

La función OPENSSL_LH_flush(), que vacía una tabla hash, contiene un error que rompe el reúso de la memoria ocupada por las entradas de la tabla hash eliminadas. Esta función es usado cuando son descodificados certificados o claves. Si un proceso de larga duración decodifica periódicamente certificados o claves, su uso de memoria será expandida sin límites y el proceso podría ser terminado por el sistema operativo causando una denegación de servicio. Además, recorrer las entradas vacías de la tabla hash llevará cada vez más tiempo. Normalmente, estos procesos de larga duración pueden ser clientes TLS o servidores TLS configurados para aceptar la autenticación de certificados de clientes. La función fue añadida en la versión 3.0 de OpenSSL, por lo que las versiones anteriores no están afectadas por el problema. Corregido en OpenSSL versión 3.0.3 (Afectado 3.0.0,3.0.1,3.0.2)

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-459
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-459

Affected Products

Vendor Product Version Update Type
openssl openssl * <built-in method update of dict object at 0x7fd36aad3b80> Application
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd36a03f500> Application
netapp clustered_data_ontap - <built-in method update of dict object at 0x7fd369e20c80> Application
netapp clustered_data_ontap_antivirus_connector - <built-in method update of dict object at 0x7fd384211f40> Application
netapp santricity_smi-s_provider - <built-in method update of dict object at 0x7fd36aad3a80> Application
netapp smi-s_provider - <built-in method update of dict object at 0x7fd36aad0ac0> Application
netapp snapmanager - <built-in method update of dict object at 0x7fd39c47a4c0> Application
netapp solidfire\,_enterprise_sds_\&_hci_storage_node - <built-in method update of dict object at 0x7fd39c40f8c0> Application
netapp solidfire_\&_hci_management_node - <built-in method update of dict object at 0x7fd3401d7800> Application
netapp a700s_firmware - <built-in method update of dict object at 0x7fd36aad1900> Operating System
netapp h300s_firmware - <built-in method update of dict object at 0x7fd2a1f92bc0> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd384210940> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd369e22ec0> Operating System
netapp h300e_firmware - <built-in method update of dict object at 0x7fd3842127c0> Operating System
netapp h500e_firmware - <built-in method update of dict object at 0x7fd3401d5280> Operating System
netapp h700e_firmware - <built-in method update of dict object at 0x7fd39f9b70c0> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd38477d4c0> Operating System
netapp aff_8300_firmware - <built-in method update of dict object at 0x7fd36aad1a00> Operating System
netapp fas_8300_firmware - <built-in method update of dict object at 0x7fd36a03ce00> Operating System
netapp aff_8700_firmware - <built-in method update of dict object at 0x7fd3841f2900> Operating System
netapp fas_8700_firmware - <built-in method update of dict object at 0x7fd369449d80> Operating System
netapp aff_a400_firmware - <built-in method update of dict object at 0x7fd3401d6100> Operating System
netapp fabric-attached_storage_a400_firmware - <built-in method update of dict object at 0x7fd369e23d80> Operating System
netapp a250_firmware - <built-in method update of dict object at 0x7fd3401d4e00> Operating System
netapp aff_500f_firmware - <built-in method update of dict object at 0x7fd2a1f90700> Operating System
netapp fas_500f_firmware - <built-in method update of dict object at 0x7fd384a66d00> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:*
Yes cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:fas_500f:-:*:*:*:*:*:*:*

References