High severity OpenSSL bug could lead to remote code execution

Jessica Haworth 06 July 2022 at 13:14 UTC

Fixes are available, update now

A high severity vulnerability in OpenSSL could allow a malicious actor to achieve remote code execution (RCE) on server-side devices.

OpenSSL is a widely used cryptography library that provides an open source implementation of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols.

It includes tools for generating RSA private keys and performing encryption and decryption, among other tasks.

Memory corruption

The OpenSSL 3.0.4 release introduced a “serious bug” in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions, an advisory states.

This issue (CVE-2022-2274) makes the RSA implementation with 2048-bit private keys incorrect, meaning memory corruption will happen during the computation.

As a consequence of the memory corruption, an attacker may be able to trigger RCE on the machine performing the computation, OpenSSL maintainers said.

Read more of the latest security vulnerability news

This issue was reported to OpenSSL on June 22, 2022, by Xi Ruoyao, who also developed the fix.

SSL/TLS servers or other servers using 2048-bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.

“On a vulnerable machine, proper testing of OpenSSL would fail and should be noticed before deployment,” the advisory reads.

Users of the OpenSSL 3.0.4 version should upgrade to OpenSSL 3.0.5. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

DON’T MISS CWE Top 25: These are the most dangerous software weaknesses of 2022