Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1yN2p3LXdwNjgtM3hjaM4AAxft
openssl-src vulnerable to Use-after-free following `BIO_new_NDEF`
The public API function BIO_new_NDEF
is a helper function used for streaming ASN.1 data via a BIO
. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.
The function receives a BIO
from the caller, prepends a new BIO_f_asn1
filter BIO
onto the front of it to form a BIO
chain, and then returns the new head of the BIO
chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO
is freed and the function returns a NULL
result indicating a failure. However, in this case, the BIO
chain is not properly cleaned up and the BIO
passed by the caller still retains internal pointers to the previously freed filter BIO
. If the caller then goes on to call BIO_pop()
on the BIO
then a use-after-free will occur. This will most likely result in a crash.
This scenario occurs directly in the internal function B64_write_ASN1()
which may cause BIO_new_NDEF()
to be called and will subsequently call BIO_pop()
on the BIO
. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream
, PEM_write_bio_CMS_stream
, PEM_write_bio_PKCS7_stream
, SMIME_write_ASN1
, SMIME_write_CMS
and SMIME_write_PKCS7
.
Other public API functions that may be impacted by this include i2d_ASN1_bio_stream
, BIO_new_CMS
, BIO_new_PKCS7
, i2d_CMS_bio_stream
and i2d_PKCS7_bio_stream
.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yN2p3LXdwNjgtM3hjaM4AAxft
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: 3 months ago
CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Identifiers: GHSA-r7jw-wp68-3xch, CVE-2023-0215
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-0215
- https://rustsec.org/advisories/RUSTSEC-2023-0009.html
- https://www.openssl.org/news/secadv/20230207.txt
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8818064ce3c3c0f1b740a5aaba2a987e75bfbafd
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9816136fe31d92ace4037d5da5257f763aeeb4eb
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c3829dd8825c654652201e16f8a0a0c46ee3f344
- https://security.netapp.com/advisory/ntap-20230427-0007/
- https://security.netapp.com/advisory/ntap-20230427-0009/
- https://security.gentoo.org/glsa/202402-08
- https://github.com/advisories/GHSA-r7jw-wp68-3xch
Affected Packages
cargo:openssl-src
Dependent packages: 9Dependent repositories: 3,600
Downloads: 20,154,884 total
Affected Version Ranges: >= 300.0.0, < 300.0.12, < 111.25.0
Fixed in: 300.0.12, 111.25.0
All affected versions: 110.0.0, 110.0.0, 110.0.1, 110.0.2, 110.0.3, 110.0.4, 110.0.5, 110.0.6, 110.0.7, 111.0.0, 111.0.1, 111.1.0, 111.1.1, 111.2.1, 111.3.0, 111.4.0, 111.5.0, 111.6.0, 111.6.1, 111.7.0, 111.8.0, 111.8.1, 111.9.0, 111.10.0, 111.10.1, 111.10.2, 111.11.0, 111.12.0, 111.13.0, 111.14.0, 111.15.0, 111.16.0, 111.17.0, 111.18.0, 111.19.0, 111.20.0, 111.21.0, 111.22.0, 111.23.0, 111.24.0, 300.0.0, 300.0.1, 300.0.2, 300.0.3, 300.0.4, 300.0.5, 300.0.6, 300.0.7, 300.0.8, 300.0.9, 300.0.10, 300.0.11
All unaffected versions: 111.25.0, 111.25.1, 111.25.2, 111.25.3, 111.26.0, 111.27.0, 111.28.0, 111.28.1, 300.0.12, 300.0.13, 300.1.0, 300.1.1, 300.1.2, 300.1.3, 300.1.4, 300.1.5, 300.1.6, 300.2.0, 300.2.1, 300.2.2, 300.2.3