GSD-2022-1002526

Source
https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002526.json
Published
2022-06-28T02:20:38.695078Z
Modified
2022-06-28T02:20:38.695078Z
Details

In OpenSSL version 3.0.4 a heap buffer overflow exists in the AVX512 support that can be attacked via network resulting in code execution. This is reachable via four code paths: RSAZ 1024, RSAZ 512, Dual 1024 RSAZ, and Default constant-time Montgomery modular exponentiation. Please note this issue is especially serious as OpenSSL 3.0.4 contains a security fix for CVE-2022-2068 which allows arbitrary code execution. This means that all users of OpenSSL 3 are affected by a number of serious security vulnerabilities. Intel AXV-512 support is present in Intel CPUs releases including Knights Landing (Xeon Phi x200, 2016), Knights Mill (Xeon Phi x205, 2017), Skylake-SP, Skylake-X (2017), Cannon Lake (2018), Cascade Lake (2019), Cooper Lake (2020), Ice Lake (2019), Tiger Lake (2020), Rocket Lake (2021). Please note that on Alder Lake (2021) AVX-512 is not officially supported, but can be enabled on some motherboards with some BIOS versions. For AMD all Zen4 CPUs contain AVX-512 support.

References

Affected packages

GSD / OpenSSL

OpenSSL

Affected ranges

Affected versions

3.*

3.0.4