CVE-2022-2274

CRITICAL

openssl-src heap memory corruption with RSA private key operation

Published July 2, 2022Updated November 8, 2023Source: osv

Summary

The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.

Remediation

Upgrade to the fixed version using your package manager.

Cargo

Update openssl-src to 300.0.9 or later

cargo update -p openssl-src --precise 300.0.9

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Package	Ecosystem	Affected	Fixed In
openssl-src	crates.io	All versions	300.0.9

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-787
Out-of-bounds WriteMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2022-2274?: openssl-src heap memory corruption with RSA private key operation This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2022-2274?: CVE-2022-2274 affects openssl-src. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-2274 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-735f-pg76-fxc4

RUSTSEC-2022-0033

Related CVEs

CVE-2022-3602
CRITICAL
X.509 Email Address 4-byte Buffer Overflow
CVE-2023-0216
HIGH
openssl-src subject to Invalid pointer dereference in `d2i_PKCS7` functions
CVE-2022-3358
HIGH
Using a Custom Cipher with `NID_undef` may lead to NULL encryption
CVE-2022-1473
HIGH
Resource leakage when decoding certificates and keys
CVE-2022-3786
HIGH
X.509 Email Address Variable Length Buffer Overflow
CVE-2021-4044
HIGH
Invalid handling of `X509_verify_cert()` internal errors in libssl
CVE-2021-3712
HIGH
Read buffer overruns processing ASN.1 strings
CVE-2023-0215
HIGH
openssl-src vulnerable to Use-after-free following `BIO_new_NDEF`

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies