ghsa-r7jw-wp68-3xch
Vulnerability from github
The public API function BIO_new_NDEF
is a helper function used for streaming ASN.1 data via a BIO
. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.
The function receives a BIO
from the caller, prepends a new BIO_f_asn1
filter BIO
onto the front of it to form a BIO
chain, and then returns the new head of the BIO
chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO
is freed and the function returns a NULL
result indicating a failure. However, in this case, the BIO
chain is not properly cleaned up and the BIO
passed by the caller still retains internal pointers to the previously freed filter BIO
. If the caller then goes on to call BIO_pop()
on the BIO
then a use-after-free will occur. This will most likely result in a crash.
This scenario occurs directly in the internal function B64_write_ASN1()
which may cause BIO_new_NDEF()
to be called and will subsequently call BIO_pop()
on the BIO
. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream
, PEM_write_bio_CMS_stream
, PEM_write_bio_PKCS7_stream
, SMIME_write_ASN1
, SMIME_write_CMS
and SMIME_write_PKCS7
.
Other public API functions that may be impacted by this include i2d_ASN1_bio_stream
, BIO_new_CMS
, BIO_new_PKCS7
, i2d_CMS_bio_stream
and i2d_PKCS7_bio_stream
.
{ "affected": [ { "package": { "ecosystem": "crates.io", "name": "openssl-src" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "111.25.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "crates.io", "name": "openssl-src" }, "ranges": [ { "events": [ { "introduced": "300.0.0" }, { "fixed": "300.0.12" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2023-0215" ], "database_specific": { "cwe_ids": [ "CWE-416" ], "github_reviewed": true, "github_reviewed_at": "2023-02-08T22:28:34Z", "nvd_published_at": "2023-02-08T20:15:00Z", "severity": "HIGH" }, "details": "The public API function `BIO_new_NDEF` is a helper function used for streaming ASN.1 data via a `BIO`. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.\n\nThe function receives a `BIO` from the caller, prepends a new `BIO_f_asn1` filter `BIO` onto the front of it to form a `BIO` chain, and then returns the new head of the `BIO` chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter `BIO` is freed and the function returns a `NULL` result indicating a failure. However, in this case, the `BIO` chain is not properly cleaned up and the `BIO` passed by the caller still retains internal pointers to the previously freed filter `BIO`. If the caller then goes on to call `BIO_pop()` on the `BIO` then a use-after-free will occur. This will most likely result in a crash.\n\nThis scenario occurs directly in the internal function `B64_write_ASN1()` which may cause `BIO_new_NDEF()` to be called and will subsequently call `BIO_pop()` on the `BIO`. This internal function is in turn called by the public API functions `PEM_write_bio_ASN1_stream`, `PEM_write_bio_CMS_stream`, `PEM_write_bio_PKCS7_stream`, `SMIME_write_ASN1`, `SMIME_write_CMS` and `SMIME_write_PKCS7`.\n\nOther public API functions that may be impacted by this include `i2d_ASN1_bio_stream`, `BIO_new_CMS`, `BIO_new_PKCS7`, `i2d_CMS_bio_stream` and `i2d_PKCS7_bio_stream`.\n", "id": "GHSA-r7jw-wp68-3xch", "modified": "2024-06-24T21:24:19Z", "published": "2023-02-08T22:28:34Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0215" }, { "type": "WEB", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8818064ce3c3c0f1b740a5aaba2a987e75bfbafd" }, { "type": "WEB", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9816136fe31d92ace4037d5da5257f763aeeb4eb" }, { "type": "WEB", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c3829dd8825c654652201e16f8a0a0c46ee3f344" }, { "type": "WEB", "url": "https://rustsec.org/advisories/RUSTSEC-2023-0009.html" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/202402-08" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20230427-0007" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20230427-0009" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20240621-0006" }, { "type": "WEB", "url": "https://www.openssl.org/news/secadv/20230207.txt" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "openssl-src vulnerable to Use-after-free following `BIO_new_NDEF`" }
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.