CVE-2021-3711
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
A bug in the SM2 decryption implementation in OpenSSL causes the first call to EVP_PKEY_decrypt() to return a buffer size smaller than actually required, leading to a buffer overflow of up to 62 bytes on the second call. An attacker can exploit this to alter data or cause application crashes.
Risk Assessment
Buffer overflow may allow an attacker to modify application data or cause crashes, potentially leading to integrity compromise or denial of service.
Recommendation
Update OpenSSL to version 1.1.1l or later, which includes the fix for this vulnerability.
Other vulnerabilities in OpenSSL
See all- CVE-2016-8610High
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
- CVE-2017-3731High
CVE-2017-3731 affects SSL/TLS servers and clients running on 32-bit hosts that may crash due to an out-of-bounds read caused by a truncated packet. For OpenSSL 1.1.0, the crash can be triggered using the CHACHA20/POLY1305 cipher, and for OpenSSL 1.0.2 using RC4-MD5.
- CVE-2017-3730High
In OpenSSL 1.1.0 before 1.1.0d, a malicious server can supply bad parameters for a DHE or ECDHE key exchange, leading to the client attempting to dereference a NULL pointer, resulting in a client crash.
- CVE-2016-7054High
In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash.
- CVE-2016-7052High
OpenSSL 1.0.2i has a vulnerability that allows remote attackers to cause application crashes by triggering a CRL operation, leading to a NULL pointer dereference.
- CVE-2016-6305High
The ssl3_read_bytes function in OpenSSL 1.1.0 before version 1.1.0a allows remote attackers to cause a denial of service (infinite loop) by triggering a zero-length record in an SSL_peek call.
- CVE-2016-6304High
Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.
- CVE-2016-6302High
The tls_decrypt_ticket function in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, allowing remote attackers to cause a denial of service via a ticket that is too short.
- CVE-2016-2179High
The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages. This allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously.
- CVE-2016-2176High
The X509_NAME_oneline function in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.
Original NVD description (English source)
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS